Projects · Ongoing

AI and security.

How can you be sure today that an architecture is secure and properly tested? AI helps find flaws, but it also creates new ones. This project gathers the precautions, frameworks and tools, then applies them to a first test bed: this site.

The landscape

AI, on the defence side and the risk side.

  • AI that defends

    Reviewing code, hunting for flaws, writing tests, analysing logs. AI systems have already found real, previously unknown vulnerabilities GoogleA summer of security: empowering cyber defenders with AI (Big Sleep, CVE-2025-6965)summer 2025Open the sourceSee in the list.

  • AI that exposes

    An application that embeds a model inherits new risks: booby-trapped instructions, data leaks, over-autonomous agents OWASPOWASP Top 10 for LLM Applications 2025 (annonce officielle)November 2024Open the sourceSee in the list.

  • Code written with AI

    Code produced by an assistant must be reviewed like code from an unknown developer: it can contain mistakes or flaws ANSSI and BSISecurity recommendations on AI-based coding assistants (French original)October 2024Open the sourceSee in the list.

AI-specific risks

The OWASP Top 10 for AI applications.

OWASP, the global reference for application security, ranks the ten major risks of applications that use a large language model OWASPOWASP Top 10 for LLM Applications 2025 (annonce officielle)November 20242025 edition, published in November 2024.Open the sourceSee in the list. The last column shows which projects on this site are concerned.

  1. LLM01
    Prompt injection

    A booby-trapped text (in a page, a document, an e-mail) hijacks the model’s instructions.

    Laws, home automation
  2. LLM02
    Sensitive information disclosure

    The model gives back data it should not have seen or kept.

    Home automation
  3. LLM03
    Supply chain

    A compromised third-party model, library or dataset.

    –
  4. LLM04
    Data and model poisoning

    Training or reference data altered to skew the answers.

    Laws
  5. LLM05
    Improper output handling

    A model answer executed or displayed without checks (code, query, HTML).

    –
  6. LLM06
    Excessive agency

    An agent with more tools and rights than it needs.

    Home automation
  7. LLM07
    System prompt leakage

    Internal instructions, sometimes with secrets, get revealed.

    –
  8. LLM08
    Vector and embedding weaknesses

    A poorly isolated or manipulated vector database, at the heart of RAG systems.

    Laws
  9. LLM09
    Misinformation

    Wrong but confident answers, reused without checking.

    Laws, finance
  10. LLM10
    Unbounded consumption

    Requests that exhaust the budget or the resources.

    –

Precautions and countermeasures

The fundamentals, then what AI adds.

The classics, still true

  • Least privilege: each account, key or service has only the rights it needs.
  • No secret in the code: keys and passwords in vaults or protected variables.
  • Regular updates of servers, containers and libraries.
  • Encryption everywhere (HTTPS) and security headers in responses.
  • Tested backups and logs kept to understand an incident.

What AI adds

  • Isolate the AI system and log its processing ANSSISecurity recommendations for a generative AI system (French original)29 April 2024Open the sourceSee in the list.
  • Separate instructions from data: a document read by the model must never be able to give it orders OWASPOWASP Top 10 for LLM Applications 2025 (annonce officielle)November 2024Open the sourceSee in the list.
  • Check every output before executing or displaying it OWASPOWASP Top 10 for LLM Applications 2025 (annonce officielle)November 2024Open the sourceSee in the list.
  • Limit an agent’s tools and rights, and keep a human in the loop for sensitive actions OWASPOWASP Top 10 for LLM Applications 2025 (annonce officielle)November 2024Open the sourceSee in the list.
  • Always review AI-generated code ANSSISecurity recommendations for a generative AI system (French original)29 April 2024Open the sourceSee in the listANSSI and BSISecurity recommendations on AI-based coding assistants (French original)October 2024Open the sourceSee in the list.
  • Do not entrust sensitive data to a public AI service ANSSISecurity recommendations for a generative AI system (French original)29 April 2024Open the sourceSee in the list.
  • Cap volumes and costs to avoid exhaustion OWASPOWASP Top 10 for LLM Applications 2025 (annonce officielle)November 2024Open the sourceSee in the list.

Core frameworks: the guide of ANSSI (France’s cybersecurity agency) for generative AI systems ANSSISecurity recommendations for a generative AI system (French original)29 April 2024Open the sourceSee in the list, its recommendations with Germany’s BSI on coding assistants ANSSI and BSISecurity recommendations on AI-based coding assistants (French original)October 2024Open the sourceSee in the list, and the OWASP Top 10 OWASPOWASP Top 10 for LLM Applications 2025 (annonce officielle)November 2024Open the sourceSee in the list.

AIs already put to the test

What they have already found.

Google · Big Sleep

A vulnerability-hunting agent that found a flaw in SQLite (CVE-2025-6965), before it could be exploited according to Google GoogleA summer of security: empowering cyber defenders with AI (Big Sleep, CVE-2025-6965)summer 2025Open the sourceSee in the list.

DARPA · AIxCC

A competition in which autonomous AI systems had to find and fix flaws in real open-source software; final in August 2025 KeysightAIxCC 2025: what it means for device security (final of DARPA’s AI challenge)25 August 2025Open the sourceSee in the list.

XBOW

An autonomous penetration-testing agent that reached the top of the HackerOne platform’s US leaderboard. Figures reported by the vendor AppSec SantaAI Pentesting Agents 2026 (including XBOW, figures reported by the vendor)2026Open the sourceSee in the list.

Anthropic · Claude Code

A security review of changes, from the command line or on GitHub. Anthropic notes that it is not hardened against prompt injection: keep it for trusted code AnthropicAutomate security reviews with Claude Code (/security-review command and GitHub Action)6 August 2025Open the sourceSee in the list.

With Claude

What an assistant can do, and what it does not do.

What it does well

  • Read the code and configuration, and spot what is risky.
  • Run the testing tools, read their results and explain them simply.
  • Propose fixes, apply them and check that they work.
  • Write automated tests that rerun every check at every update.
  • Review every change with the /security-review command AnthropicAutomate security reviews with Claude Code (/security-review command and GitHub Action)6 August 2025Open the sourceSee in the list.

The guardrails

  • It asks for permission before sensitive actions, and secrets stay in my hands: on this site, I installed the keys myself.
  • It only tests systems I am responsible for or have written permission for.
  • Its conclusions get checked: a tool or an AI can be wrong both ways.

The toolbox

ToolWhat it checks
Mozilla HTTP ObservatoryA site’s security headers
SSL LabsHTTPS and TLS configuration
testssl.shTLS, from the command line
nmapExposed ports and services
OWASP ZAPWeb vulnerability scanning
WPScanWordPress security
gitleaksSecrets in code and Git history
TrivyFlaws in Docker images and dependencies
Dependabot and CodeQLDependencies and code analysis on GitHub
Claude Code /security-reviewAI security review of changes

First test run

This site, tested first.

Three non-intrusive analyses on the same day: what the site and the private area return to any visitor, before the fixes, after the security headers, then after the private area’s content policy. Compliant points: 4 out of 11 Author’s checkHTTP headers and TLS configuration of bertrand-didier.tech and the private area, read with curl and openssl2 November 2026Open the sourceSee in the list, then 10 Author’s checkAnalysis 2, after remediation: same curl and openssl checks2 November 2026Open the sourceSee in the list, then 11 Author’s checkAnalysis 3, after the private area’s CSP: same curl and openssl checks2 November 2026Open the sourceSee in the list.

bertrand-didier.tech

Mozilla HTTP Observatory Mozilla HTTP ObservatoryGrades of bertrand-didier.tech and prive.bertrand-didier.tech at each analysis2 November 2026Open the sourceSee in the list

DA+A+

30 → 110 → 110 points · 8 → 12 → 12 of 12 tests passed

SSL Labs, TLS configuration: A+ Qualys SSL LabsSSL Server Test of bertrand-didier.tech and prive.bertrand-didier.tech2 November 2026Open the sourceSee in the list

prive.bertrand-didier.tech

Mozilla HTTP Observatory Mozilla HTTP ObservatoryGrades of bertrand-didier.tech and prive.bertrand-didier.tech at each analysis2 November 2026Open the sourceSee in the list

DBA+

30 → 75 → 110 points · 8 → 11 → 12 of 12 tests passed

SSL Labs, TLS configuration: A+ Qualys SSL LabsSSL Server Test of bertrand-didier.tech and prive.bertrand-didier.tech2 November 2026Open the sourceSee in the list

Analysis 1, recommendation, analyses 2 and 3

Item checkedAnalysis 1 (before)Recommendation appliedAnalysis 2Analysis 3
HTTPS and valid certificateOKNothing to changeOKOK
TLS protocols: 1.2 and 1.3 accepted, 1.0 and 1.1 refusedOKNothing to changeOKOK
Automatic redirect from HTTP to HTTPSOKNothing to changeOKOK
HSTS: force HTTPS in the browserMissingStrict-Transport-Security, 1 year, subdomains includedOKOK
Content-Security-Policy: allow only the expected scriptsMissingStrict policy on the site, then on the private area’s public pageOK on the site onlyOK
Embedding in another page (clickjacking)MissingX-Frame-Options SAMEORIGIN and frame-ancestorsOKOK
X-Content-Type-OptionsMissingnosniffOKOK
Referrer-PolicyMissingstrict-origin-when-cross-originOKOK
Permissions-PolicyMissingBlock camera, microphone, geolocation, payment, USBOKOK
Server versions (nginx, Apache, PHP)VisibleRemove the Server and X-Powered-By headersHiddenHidden
Private area: content, API and feeds closed to anonymous visitorsOKNothing to changeOKOK

What was put in place

  • In Traefik, a set of security headers shared by the site, the market API and the private area, which also removes the headers revealing versions.
  • A strict Content-Security-Policy for the site: only its own scripts run, and Google fonts are the only external resources allowed.
  • The site no longer puts any script directly in its pages, a condition for this strict policy.
  • For the private area, the WordPress module sends an even stricter policy (no script at all) on the page for visitors who are not logged in; the admin, which needs its own scripts, is not affected.
  • For the private area, two-factor login: after the password, a 6-digit code from an app such as Google Authenticator, with backup codes. It relies on WordPress’s official Two Factor plugin, which is free.
  • After every deploy, GitHub Actions checks these headers live and fails the release if one is missing.

The remediation test plan

TestHowExpected resultStatus
Security headers stay in place on all three services“Check security headers” step in GitHub Actions, after every deployAll present, CSP included, otherwise the deploy failsAutomated
No response reveals a server versionSame automated stepNo Server or X-Powered-By with a numberAutomated
Mozilla HTTP Observatory gradePublic scan of both addresses, once a monthA+ for both addressesDone on 2 November: A+ and A+
The CSP breaks no pageVisit every page, browser console free of errorsCharts, animations, fonts and quotes loadDone on 2 November
Logging in to the private area worksLogin page and WordPress dashboardForm shown and login succeedsPage checked; login to test with a real account
Content-Security-Policy for the private areaStrict policy sent by the WordPress module on the page anonymous visitors seePage shown without errors; WordPress admin unchangedDone on 2 November
Detailed TLS configurationSSL Labs, on both addressesGrade A or betterDone on 2 November: A+
Two-factor login for the private areaLog in with the password, then the 6-digit code from the authenticator appCode required at every login; backup codes availableEnabled and tested on 2 November
Rollback possibleDated copies of the configurations on the serverRestore the previous state in one commandReady

The rest of the test plan

  1. 01

    Security headers

    Mozilla HTTP Observatory Done: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy in Traefik; grade raised from D to A+.

  2. 02

    Hide versions

    curl Done: nginx, Apache and PHP version numbers no longer show.

  3. 03

    Full TLS configuration

    SSL Labs Done: A+ on both addresses, TLS 1.2 and 1.3 only, no warnings.

  4. 04

    Server exposed surface

    nmap List the VPS’s open ports and close anything that does not need to be public.

  5. 05

    Private area (WordPress)

    WPScan Partly done: two-factor login enabled and tested. Versions, plugins and accounts still to scan.

  6. 06

    Application scan

    OWASP ZAP Browse the site and the API like an attacker, passively then actively.

  7. 07

    Dependencies

    npm audit, Dependabot Flag and update vulnerable libraries.

  8. 08

    Secrets and Git history

    gitleaks Check that no key has ever been published in the repository.

  9. 09

    Containers

    Trivy Look for known flaws in the Docker images.

  10. 10

    Assisted code review

    Claude Code /security-review Have every change reviewed by the AI, then by me.

The legal framework. Testing a system without permission is an offence: unauthorised access to a computer system, article 323-1 of the French Criminal Code, article 509-1 in Luxembourg. These tests only cover my own servers.

Sources

Publications used.

  1. 1
  2. 2
  3. 3
  4. 4
  5. 5
  6. 6
  7. 7
  8. 8
  9. 9
  10. 10
  11. 11
  12. 12