{
  "id": 5964318,
  "title": "Building DevLog: What Happens When You Tell an AI to Think Like a Security Engineer First",
  "url": "https://urgent.news/2026/09/06/building-devlog-what-happens-when-you-tell-an-ai-to-think-like-a",
  "topic": "ai",
  "section": "AI",
  "published": "2026-09-06T11:07:32.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/sa_a_334b500fa1f/building-devlog-what-happens-when-you-tell-an-ai-to-think-like-a-security-engineer-first-5b1b"
  },
  "original_language": "en",
  "account": "When the challenge began, the objective was to create a Personal Gemini Journal - an authenticated app that allows users to chat with Gemini, who would then save their reflections. However, the core focus wasn't the journal itself but the process leading up to its creation: instructing Google AI Studio to operate as a security engineer, rather than merely a code generator.\n\nThe first step involved teaching AI Studio to conduct threat modeling before any features were implemented. This was achieved by establishing a structured constitution that required AI Studio to produce a Threat Summary Table detailing risks and corresponding countermeasures for five zones: input surfaces, planning/reasoning, tool execution, memory/state, and inter-system communication.\n\nFor instance, when discussing input surfaces, potential risks included prompt injection, malformed JSON payloads, and client tampering with log identifiers or user IDs. The corresponding controls aimed at mitigating these risks included treating all user input as untrusted data, implementing defensive payload ingestion, and employing zero-trust path checks to ensure records only wrote to authenticated user-specific locations.\n\nThroughout the development process, this security-first approach led to the creation of DevLog - a debugging journal for developers. Rather than saving user reflections, DevLog executed a separate extraction call using Gemini's structured JSON output mode, extracting details such as bug title, root cause, resolution, tags, difficulty level, and resolution status.\n\nOne notable feature emerged from this structured approach: Pattern Radar. This allowed users to aggregate their tagged data over time and view their most frequent failure modes without additional Gemini calls. This not only enhanced the app's functionality but also demonstrated the authenticity of the structured-extraction discipline that the security directives had instilled.\n\nIn terms of user interface, the AI-generated default design was unremarkable. However, by providing specific token values for design elements, AI Studio was able to produce a clean, well-structured interface that deviated from the typical AI Studio demos. The challenge accepted a written walkthrough instead of a live URL, and following the completion of DevLog, the billing account was closed, and further development continued within AI Studio's own preview environment.",
  "summary": "Submission for the Cloud Run AI Challenge — #AccelerateAIwithCloudRun When I started this challenge, the brief was to build a \"Personal Gemini Journal\" — an authenticated app where you chat with Gemini and it saves your reflections. Simple enough on paper. The actual point of the challenge, though, wasn't the journal. It was what happens before you write a single line of code: configuring Google…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}