Notes from building things. AI-assisted development, security research, and the local lab.
Rejected bug bounty reports cost me real money, so I trained small specialised models to predict vulnerability chains like IDOR into privilege escalation. The synthetic data overfit, which turned out to be the lesson.
Claude's context limit forced me into better testing practices, and AI turned out to bridge the gap between an ADHD brain and rigid corporate tooling. Constraints as the useful part.
Gemini Code Assist kept writing Svelte 4 syntax into my Svelte 5 components, mixing reactive statements with runes and producing update loops that crashed the dev server. The prompting playbook that came out of it.
A productivity boost is not the same as knowing how to work with these tools. Treating each AI assistant as having its own personality, and the two-phase process I settled on for complex features.
Building a bug bounty toolkit in three weeks with Google Gemini and Code Assist, after starting in the terminal and hitting the limits of a CLI. What worked, and where the AI lost the plot.