I just published When $951 Buys $8.5 Million: The Term Finance Governance Attack Explained medium.com/@martinyeunghk/wh…
I just published The Sandbox SAND Bridge Exploit: A Technical Deep Dive into the approveAndCall Delegate Hijack… medium.com/@martinyeunghk/th…
I just published The Hidden Cost of ‘Lossless’ Pruning — A Deep Dive into Pi Agent Harness medium.com/@martinyeunghk/th…
I just published In-depth analysis of the Coldcard hardware wallet RNG vulnerability: How a macro definition led to… medium.com/p/the-coldcard-en…
#Coldcard #blockchain #security #wallet
Your AI chatbot just cost you $5,000 at 3 AM.
Prompt injection is the #1 OWASP risk—but most guardrails are Python-only or SaaS-locked.
I built a security tool alternative that actually stops scams.
Here’s how @martin_yeung/llm-up-guardrail saves your infra and sleep) 🧵👇
Get started in 30 seconds:
npm install @martin_yeung/llm-up-guardrail
Stop the 3 AM alerts. Protect your users.
☕ Support: ko-fi.com/martinyeung
How does it stack up?
• LLM Guard? no multi-turn.
• Lakera? SaaS lock-in + recurring costs.
• JailGuard? Single-threat (injection only).
@martin_yeung/llm-up-guardrail is the only TypeScript-native tool with:
✅ Scam-first design
✅ Behavioral tracking
✅ Zero vendor lock-in
Built for the Node.js/TypeScript ecosystem:
⚡️ Zero runtime dependencies (no supply-chain bloat)
🔷 Full ESM + CJS, complete TypeScript types
🔌 Drop-in Express Middleware
🦜 LangChain-style wrapper
No external API calls required. Your data stays self-hosted and private.
The Anti-Scam engine is the flagship, but covers OWASP Top 10:
✅ InjectionGuard (Jailbreak/DAN detection)
✅ PIIGuard (API keys, SSN, credit cards + entropy detection)
✅ ToxicityGuard (Self-harm, hate speech)
✅ URLSafetyScanner (Brand impersonation, shorteners, punycode)
Most guardrails stop at regex. @martin_yeung/llm-up-guardrail goes 3 layers deep:
1️⃣ Pattern Matching (20+ curated EN/CH scam rules)
2️⃣ LLM Semantic Analysis (OpenAI/Anthropic for ambiguous cases)
3️⃣ Behavioral Tracking (catches scams that unfold over multiple turns)
It’s 3 AM. You wake up to a alert.
Your shiny new AI support bot just handed out gift cards to a scammer who asked nicely.
This isn't a hypothetical. It's happening to production systems right now.
Most models don't understand social engineering. They just follow instructions.
I just published Beyond Data Privacy: New Privacy Risks for Large Language Models (arXiv:2509.14278, 2026) medium.com/p/beyond-data-pri…
I just published DSpark: Confidence-Scheduled Speculative Decoding with Semi-Autoregressive Generation medium.com/p/dspark-confiden…
#LLM #DSpark
I just published Flock: Fast Proving for Batch Boolean Computations medium.com/p/flock-fast-prov…
I just published PIG: Privacy Jailbreak Attack on LLMs via Gradient-based Iterative In-Context Optimization medium.com/p/pig-privacy-jai…
I just published Freeing the Law with LOCUS: A Local Ordinance Corpus for the United States (Denis Peskoff, Joe… medium.com/p/freeing-the-law…
#LOCUS #law #AI