01 / 05 · Live
CyberCookie
A model reads the news. A validator reads the model.
Python · Next.js 16 · Anthropic SDK · Supabase · Upstash Redis · GitHub Actions
The problem
Cybersecurity and AI news moves too fast to read by hand, and models can invent facts or be steered by hostile web text. CyberCookie writes a short daily digest and checks it with code before it is published.
My role
Solo. I built the whole system: feed ingest, three LLM agents, the parser and validation gate, the GitHub Actions runs, the Supabase schema and the Next.js site.
How it works
- InputScrape RSS feeds48h window, dedupe, CVE regex
- ScorerScore and pick storiesScorer agent picks one per section
- WriterWrite the issueWriter agent drafts from full articles
- ReviewerReview onceReviewer agent fact-check, one revision
- Code gateParse and validateStrict rules, bad links stripped
- OutputPublish and notifySupabase write, Telegram alert
Model stepHuman or code gatePlain step
What I built
- 01Built a two-edition pipeline where one registry file drives the prompts, parser and checks, and fails at import if they disagree
- 02Added a deterministic publish gate and link allowlist after a malformed issue reached the database with zero sections
- 03Automated alternating daily runs on GitHub Actions, with parser tests before any API spend and a Telegram alert on failure
- 04Built a Next.js site on Supabase with read-only public access, archive, search, CVE and stats pages, and a fail-open rate limiter
Trust boundaries · where the AI is held in check
- AScraped article text is treated as untrusted data in the Writer prompt, as defence in depth rather than a guarantee.
- BLink stripping and the issue validator are plain code, so they hold even if the model or the reviewer gets it wrong.
- CA failed database write exits non-zero, so the CI run fails instead of reporting green.
Hardest part
The model once dropped the section headings and published an empty issue with no error. The fix moved the guarantee into code: a strict validator, a link allowlist, rollback on failed writes, and tests built from real drafts.
Outcome
128 issues published since June 2026 (96 Cyber, 32 AI) and 93 CVEs tracked, all visible on the live stats page.
Screens
