← Portfolio · Case Study

Flare — AI Stack Exposure Checker

App · Built with Claude Code · 2026

Independent project

The challenge

Most teams shipping AI features now depend on a fast-moving stack of model provider SDKs, orchestration frameworks, and inference servers — packages with a much higher rate of newly disclosed vulnerabilities than the mature libraries most teams are used to tracking. There’s no single place to check whether anything you actually run is currently affected by something serious without manually watching a dozen separate GitHub security-advisory feeds, and the risks that matter most in AI systems — prompt injection, excessive agency, data exfiltration through a model — never show up as a CVE at all, so a patching workflow alone misses them entirely.

What I built

Designed and built a free tool that lets you pick the specific packages in your AI stack from a curated watchlist and see what’s currently live, high-severity, and worth patching this week — ranked by what to fix first, not by publish date. Every advisory is cross-referenced against CISA’s Known Exploited Vulnerabilities catalog to flag the ones already under real-world attack, and against the advisory’s own citations for corroborating third-party coverage. A permanent OWASP LLM Top 10 reference sits alongside the live checker for the design-level risks that will never appear as a package CVE. The interface follows a console/dashboard pattern — a persistent status bar, live sync indicator, and an always-visible summary panel — rather than a one-shot report you generate and forget.

Outcomes

  • A curated 45-package watchlist across seven groups — model provider SDKs, orchestration, serving/inference, vector databases, MLOps tooling, app frameworks, and LangChain’s JS/TS packages — plus lookup for any custom package by name
  • Checks OSV.dev live on every page load, with a visible "last synced" freshness indicator instead of a static, unlabelled snapshot
  • A daily GitHub Actions workflow refreshes the advisory data automatically, with sanity gates (an advisory-count floor and a regression check against the previous snapshot) that refuse to publish if OSV.dev returns implausibly little data
  • Cross-links with AI-SHIELD — a live-check citation on its vendor-vetting question, and a one-time stack suggestion driven by the deployment pattern you told AI-SHIELD you use — so package-level CVE risk and organisational AI security maturity read as two halves of the same picture

Tech & approach

Claude Code · Static HTML/CSS/JS · OSV.dev public API · GitHub Actions for scheduled data refresh · No backend, no dependencies