LLM Evals & Safety
Measuring whether your AI actually works, and containing the damage when it doesn’t.
Guardrails Are Two Checkpoints, Not One
Most AI guardrail setups only check one side of the conversation. Here’s why you need an input check and an output check, and how to build both.
Tip #050A Prompt Will Break, So Limit the Blast Radius
You can’t filter out every prompt injection. Here’s how to limit what a hijacked AI agent can actually do with least-privilege tools and human approval.
Tip #051Your A.I. Judge Has Favorites, Check For Them
LLM-as-judge scales evaluation past manual review, but it inherits biases. Here’s how to run a positional-swap test before you trust the score.
Tip #139Run One Unit Before You Scale
Before you run 10,000 AI calls, run one. Measure the real cost, then scale — with the exact per-unit math and the 50% batch discount.
Tip #140Put a Hard Per-Job Cap on Every Automated AI Call
A bug in an automated AI job should produce a bounded bill, not an unbounded one — cap tokens, items, and time per call, then put a budget alarm on the account.
Tip #166Secrets Deleted in a Later Docker Layer Still Live in History
A secret copied or used in a Dockerfile RUN step is baked into that layer forever — deleting it later doesn’t erase it, and anyone can extract it with one command. Use build secrets instead.
Tip #167Replace Long-Lived AWS Keys With OIDC
Static AWS access keys in CI never expire, so a single leak works until someone notices. Swap them for OIDC role assumption and get short-lived credentials with nothing stored to steal.
Tip #168Audit Postinstall Scripts on Any Package
npm install can run a stranger’s shell script the moment you install. Audit postinstall and prepare hooks and flag any that reach the network or shell, so you catch supply-chain code execution before it runs.
Tip #169The System Prompt Is Not a Security Boundary, Code Is
A do-not-reveal instruction in your system prompt stops nothing, because a motivated user can talk the model out of any instruction. Enforce security with deterministic code that brackets the model call: an input screen before, an output scrub after.
Tip #170Your Agent Config Is an Attack Surface
Instruction files, settings, and MCP server configs steer your coding agent, so a hidden instruction or a leaked key in there is a real breach path. Scan them like code for wildcard permissions, hardcoded secrets, and injected instructions.
Tip #171When Your Pipeline Reads Uploads, the Content Is the Attacker
When your AI pipeline ingests uploads or scraped pages, the content itself is the attacker. Treat untrusted content as data, never instructions: delimit it before the model sees it, and never let it flow unescaped into a shell, SQL, or a file path.
Tip #194Give Each Severity Level a Confidence Floor
When every AI finding is flagged critical, people stop reading. Gate each severity on a confidence floor and downgrade a tier under uncertainty, so a critical actually means stop and fix.