I shipped a Series‑A‑grade security autopilot in one day. It costs €2.60/year.

说明与用途

一日构建的安全自动化管道，年成本 €2.60，自动检测漏洞、测试并安全发布到生产环境。

问题

Solo founders lack dedicated security teams, making production deployments vulnerable to automated scanners and common misconfigurations.

结果

Implemented a low‑cost, fully automated security pipeline that reduces manual oversight, catches critical vulnerabilities before production, and ensures safe deployment with a 7‑day soak period.

工作流

• Run SecurityRadar weekly to aggregate advisories from npm audit, GitHub Advisories, NVD, and vendor RSS feeds; filter and classify with Claude Haiku; email critical findings and log proposals.
• Use Dependabot to open PRs to dev; auto‑merge bot squash‑merges when CI passes; skip major bumps until human review.
• Run Muraqib nightly Playwright tests against dev; log results in GitHub Actions.
• Promote dev to main only after seven consecutive green Muraqib runs and risk‑gate checks; fast‑forward merge.
• After push to main, wait 90s and poll /api/health for 15 min; if three consecutive 5xx, revert and alert; otherwise keep deployment.
• Maintain low cost by filtering before LLM calls and using free sources.

证据

Total cost of running it: €2.60 per year in LLM tokens. Total time to build it: one day, with Claude doing the typing.

来源

Six moving parts. Each is the simplest possible implementation of its job. None of them are clever. The cleverness is that they're chained.

来源