I built an open-source tool that stops personal data from leaking into AI chatbots

Demo of ShadowAudit scanning API and masking it.

Ever copy-pasted something into ChatGPT and immediately
thought “wait, should I have done that?”

If you’re building an AI app that handles user data, you need to know what’s leaking into your LLM API before a regulator does.

That’s the problem ShadowAudit solves.

It sits between your app and any LLM API and scans every
prompt before it leaves your system — catching emails,
phone numbers, API keys, and Indian national IDs like
Aadhaar and PAN numbers.

Two lines to integrate:

sa = ShadowAudit.from_config("shadowaudit.yaml")
client = sa.wrap(openai.OpenAI())

That’s it. Everything else stays the same.

It also generates GDPR Article 30 compliance reports
automatically from your audit log — one command, done.

Demo of ShadowAudit scanning API and masking it.

Built this over summer as part of my open-source portfolio.
Would love feedback from the community.

GitHub: github.com/Jeffrin-dev/ShadowAudit

Cookie Guard: The GDPR/CCPA Consent Manager (No Dependencies, 12.8 kB, 22 Languages)

Cookie Guard 🛡️

GDPR/CCPA compliance Cookies Consent Management.

A GDPR/CCPA 2026 compliance, simple and customizable Cookies Management system.

MAIN FEATURES

  • Legal Compliance: Fully GDPR/CCPA compliant workflow (2026 standards).
  • Hybrid Modes: Supports both full third-party consent and “no-cookies” informational mode.
  • Smart Execution: Auto-activates Analytics/Marketing scripts (handles type="text/plain").
  • Zero Dependencies: Pure Vanilla JavaScript; no jQuery or external libraries required.
  • Privacy Focus: Optional persistent “Privacy” floating button to re-open settings.
  • Legal Terms: Optional acceptance and Legal URL smart handling.
  • Global Reach: Support for 22 languages (LTR & RTL) with automatic browser detection.

    • Locales: en, es, ca, eu, gl, et, ar, pt, pl, vi, fr, de, it, ru, zh, ja, id, ko, tr, nl, hi, bn.
  • Performance: Ultra-lightweight architecture (~12.8 kB minified).

  • Accessibility: Implements ARIA standards for screen readers.

  • Encapsulation: Built within an IIFE to ensure no global namespace pollution.

  • UI/UX: Dynamic CSS/HTML injection with a fully responsive, mobile-first design.

  • Customization: Flexible configuration for expiration, link colors, and button border-radius.

  • Developer API: Public toggle, open, and reset methods for external control.

📦 Installation

Add the minified version before the closing </body> tag:

<script 
    src="https://opensource.josebamirena.com/cookie-guard/3.0.0/dist/cookie-guard.min.js" 
    integrity="sha384-4TomZ6aXKNjC0fGi+v+GQTBp9kmS006nQ3SriGo6U0a93lhADVwmw8toL8JQW4vB" 
    crossorigin="anonymous">
</script>

⚙️ Configuration

Cookie Guard default Initialization

<script>
    document.addEventListener('DOMContentLoaded', () => CookieGuard.init());
</script>

Initialization default variables and values

Property Type Default Description
locale string auto ‘auto’ or 2-letter language ISO code.
consent boolean true true for 3rd party scripts, false for info-only banner.
url string null Relative URL to your legal/cookies policy page.
reopen boolean true Renders the floating privacy button.
radius integer 12 Buttons border-radius in pixels.
delay integer 800 Modal entrance delay in milliseconds.
link string #3b82f6 Primary link color.
hover string #10b981 Link hover color.
separator string • Modal footer links separator
expiration integer 365 Consent cookie expiration in days.
<script>
    const defaults = {
        locale: 'auto', // @string 'auto' or 2-letter ISO code.
        consent: true, // @bool true for 3rd party scripts, false for info-only banner.
        url: null, // @null|string Relative URL to your legal/cookies policy page.
        reopen: true, // @bool Renders the floating privacy button.
        radius: 12, // @int Buttons border-radius in pixels.
        delay: 800, // @int Modal entrance delay in milliseconds.
        link: "#3b82f6", // @string Primary link color.
        hover: "#10b981", // @string Link hover color.
        separator: "•", // @string Modal footer links separator
        expiration: 365, // @int Consent cookie expiration in days.
    };
</script>

Cookie Guard Customized Example

<script>
    document.addEventListener('DOMContentLoaded', () => 
        CookieGuard.init({
            locale: 'en', // fixed language
            url: "/legal", // legal relative url
            link: "#ff0000", // red links
            radius: 8, // buttoms radius
        })
    );
</script>

Cookie Guard non third party cookies mode

<script>
    document.addEventListener('DOMContentLoaded', () => 
        CookieGuard.init({
            locale: 'auto', // auto detect language
            consent: false, // no third party cookies mode
        })
    );
</script>

🛠️ Script Implementation

To let Cookie Guard manage your scripts, add the type attribute text/plain and add the data-cg-category attribute (analytics|marketing):

Test script example

<script 
    type="text/plain" 
    data-cg-category="analytics">
    console.log('Analytics script executed');
</script>

Analytics script example

<script 
    type="text/plain" 
    data-cg-category="analytics" 
    src="https://www.googletagmanager.com/gtag/js?id=UA-XXXXX-Y">
</script>

Marketing script example

<script type="text/plain" data-cg-category="marketing">
    console.log("Facebook pixel is legally enabled.");
    fbq('init', '123456789');
    fbq('track', 'PageView');
</script>

🕹️ Developer API

Toggle Modal

<a href="javascript:void(0)" onclick="CookieGuard.toggle()">Privacy</a>

Force Open

<a href="javascript:void(0)" onclick="CookieGuard.open()">Open Privacy</a>

Hard Reset:

Debug Shortcut: CTRL + SHIFT + X to reset state instantly.

<a href="javascript:void(0)" onclick="CookieGuard.reset()">Reset Privacy</a>

🎯 Live Demo

Try Cookie Guard live on my website:

👉 Cookie Guard Demo

See how it handles consent, 22 languages, and third-party script blocking in action.

PocketBase Has a Free API You Should Know About

PocketBase is a single binary that gives you a full backend: REST API, realtime subscriptions, auth, file storage, and admin dashboard.

Instant REST API

Create a collection in the admin UI, and you immediately get full CRUD:

# List records
curl 'http://127.0.0.1:8090/api/collections/posts/records?page=1&perPage=20'

# Create record
curl -X POST 'http://127.0.0.1:8090/api/collections/posts/records' 
  -H 'Content-Type: application/json' 
  -d '{"title": "Hello World", "content": "My first post"}'

# Update record
curl -X PATCH 'http://127.0.0.1:8090/api/collections/posts/records/RECORD_ID' 
  -d '{"title": "Updated Title"}'

# Delete record
curl -X DELETE 'http://127.0.0.1:8090/api/collections/posts/records/RECORD_ID'

JavaScript SDK

import PocketBase from 'pocketbase'

const pb = new PocketBase('http://127.0.0.1:8090')

// Auth
await pb.collection('users').authWithPassword('[email protected]', 'password')

// CRUD
const posts = await pb.collection('posts').getFullList({
  sort: '-created',
  filter: 'published = true',
  expand: 'author'
})

const newPost = await pb.collection('posts').create({
  title: 'New Post',
  content: 'Content here',
  author: pb.authStore.model.id
})

Realtime Subscriptions

// Subscribe to changes
pb.collection('messages').subscribe('*', (e) => {
  console.log(e.action) // 'create', 'update', 'delete'
  console.log(e.record)

  if (e.action === 'create') {
    messages = [...messages, e.record]
  }
})

// Subscribe to specific record
pb.collection('posts').subscribe('RECORD_ID', (e) => {
  console.log('Post updated:', e.record)
})

// Unsubscribe
pb.collection('messages').unsubscribe()

File Uploads

const formData = new FormData()
formData.append('title', 'My Photo')
formData.append('image', fileInput.files[0])

const record = await pb.collection('gallery').create(formData)
const imageUrl = pb.files.getUrl(record, record.image)

Custom Backend Hooks (Go)

// main.go — extend PocketBase with custom logic
func main() {
    app := pocketbase.New()

    app.OnRecordAfterCreateRequest("orders").Add(func(e *core.RecordCreateEvent) error {
        // Send notification after order created
        return sendOrderNotification(e.Record)
    })

    app.OnBeforeServe().Add(func(e *core.ServeEvent) error {
        e.Router.GET("/api/custom/stats", func(c echo.Context) error {
            stats := computeStats(app.Dao())
            return c.JSON(200, stats)
        })
        return nil
    })

    app.Start()
}

Real-World Use Case

An indie hacker needed a backend for their SaaS MVP: user auth, data storage, file uploads, realtime updates. Instead of Firebase ($$$) or building from scratch (weeks), they downloaded PocketBase (1 binary, 15MB), ran it, and had a full backend in 10 minutes. It runs on a $5 VPS handling 10K users.

PocketBase is the backend-in-a-box that actually works.

Build Smarter Data Pipelines

Need to scrape websites, extract APIs, or automate data collection? Check out my ready-to-use scrapers on Apify — no coding required.

Custom scraping solution? Email me at [email protected] — fast turnaround, fair prices.

Basic Select SQL Queries

Let me explain it with some Hackerank problems:

QN: 1
Query all columns for a city in CITY with the ID 1661
ANS: SELECT * from CITY where ID = 1661;

it is to select all columns from table city and the condition is for ID = 1661.

QN: 2
Query all attributes of every Japanese city in the CITY table. The COUNTRYCODE for Japan is JPN.
ANS: SELECT * from CITY where COUNTRYCODE= ‘JPN’;

it is to select all attributes from the table city and the condition is for a COUNTRYCODE =JPN

QN:3
Query the NAME field for all American cities in the CITY table with populations larger than 120000. The CountryCode for America is USA.

ANS: SELECT NAME from CITY where POPULATION > 120000 and COUNTRYCODE = ‘USA’;

since it is to select all the names from the table city condition is population is more than 120000 and CountryCode =USA

QN:4

Query the list of CITY names from STATION that do not start with vowels. Your result cannot contain duplicates.
ANS: SELECT DISTINCT CITY FROM STATION WHERE CITY NOT LIKE”A%” AND CITY NOT LIKE “E%”AND CITY NOT LIKE “I%”AND CITY NOT LIKE “O%”AND CITY NOT LIKE “U%”;

Since, it is to select the unique city names from the table STATION and the condition is to the names of the city should not start with vowels(a,e,i,o,u). A%,E%,I%,O%,U% is that all other character after that are considered.so this represents the first letter.

QN:5

Query a list of CITY and STATE from the STATION table.
ANS: SELECT CITY,STATE FROM STATION;

we need both city and state columns from table STATION we select both table

QN:6

Query all columns for all American cities in the CITY table with populations larger than 100000. The CountryCode for America is USA.

ANS: SELECT * FROM CITY WHERE POPULATION >100000 AND COUNTRYCODE = ‘USA’;
Since, it is to select all from table CITY . the condition is where population is more than 100000 and COUNTRYCODE IS USA

QN:7

Find the difference between the total number of CITY entries in the table and the number of distinct CITY entries in the table.
ANS: SELECT COUNT(CITY)-COUNT(DISTINCT CITY) from STATION;

here it is asked for the difference between all city and unique city names to find the repetition we use COUNT keyword to city and distinct city .

QN:8
Query the names of all the Japanese cities in the CITY table. The COUNTRYCODE for Japan is JPN
ANS: SELECT NAME FROM CITY WHERE COUNTRYCODE = ‘JPN’;

it is to select the names of the city from table CITY and the condition is COUNTRYCODE to be JPN

What a week without Postman taught me about my API workflow

For years, my API testing routine revolved around a familiar setup: open Postman, fire requests, tweak headers, repeat. It was efficient enough, or so I thought. Then I decided to step away from it for a week and rely entirely on a different approach – a native API client on my Mac. That small experiment turned into a surprising audit of how I actually work with APIs.

The first thing I noticed was how dependent I had become on muscle memory rather than understanding. With my usual REST API client, I had a predefined structure: collections, environments, and saved requests. Without it, I had to think more deliberately about each endpoint. Instead of clicking through folders, I started asking: What does this endpoint expect? What does it return? That shift alone improved my clarity.

Working with a native API client also made the experience feel lighter. There was no context switching between apps or dealing with bloated workspaces filled with outdated requests. Everything felt closer to the system—faster to open, quicker to execute, and easier to manage. I didn’t realize how much friction I had accepted as normal until it disappeared.

Another lesson came from handling environments and variables. In my usual setup, I relied heavily on pre-configured environments. While convenient, it also made me a bit careless. During this week, I had to define variables more consciously. I paid closer attention to authentication tokens, base URLs, and headers. This made debugging easier because I knew exactly where things were coming from instead of hunting through layers of abstraction.

Response analysis was another area where my workflow changed. Earlier, I would skim through responses unless something broke. Without that habit, I began inspecting responses more closely—status codes, headers, payload structure. I started catching small inconsistencies early, things that would have otherwise slipped into later stages. It wasn’t about spending more time, but about being more intentional with the time spent.

Documentation habits improved too. When you’re not relying on a heavily structured REST API client, you naturally start documenting things better. I began noting down endpoint behaviors, edge cases, and expected responses in a cleaner format. This made it easier to revisit requests later without relying on memory or digging through saved collections.

One unexpected benefit was how it influenced collaboration. Sharing requests from a native API client felt more straightforward. Instead of exporting bulky collections, I could share clean, minimal configurations or even simple request formats. This reduced confusion and made it easier for others to reproduce issues or test scenarios.

Performance and speed also stood out. A native API client feels more aligned with the operating system. Requests fired instantly, and there was less waiting around for the interface to catch up. Over time, these small gains added up, making the workflow feel smoother and less interrupted.

However, the biggest takeaway wasn’t about tools—it was about awareness. The week forced me to rethink habits I had built over time. I realized that tools should support clarity, not replace it. A good REST API client should enhance how you think about APIs, not hide the details behind layers of convenience.

That doesn’t mean traditional tools are bad. They are powerful and have their place. But relying on them too heavily can create blind spots. Stepping away, even briefly, can reveal inefficiencies and help you rebuild a more intentional workflow.

By the end of the week, I didn’t just learn how to work without my usual setup. I learned how to work better with it—or without it. The experience reinforced the value of simplicity, speed, and clarity in API testing.

If you’ve been using the same setup for a long time, it might be worth trying something different. You may not switch permanently, but you’ll definitely learn something about how you work.

Download HTTPBot

The World as an Interface

Infographic

We are standing at the threshold of a new computational paradigm. The era of conscious interaction with devices, of deliberately tapping screens and typing commands, is beginning to recede. In its place, a quieter, more pervasive form of computing is emerging, one that weaves itself into the fabric of our daily lives. This is the world of ambient intelligence, where the environment itself becomes the interface. It’s a future where our homes, offices, and cities don’t just contain technology, but are technology, constantly sensing, processing, and acting on our behalf, often without a single explicit command.

The journey toward this future wasn’t a sudden leap but a gradual dissolution of boundaries. First, computers left the desktop and entered our pockets. Then, they attached themselves to our wrists, our ears, and our eyes. Each step made the interaction more immediate, more personal, and less obtrusive. The smartphone was a revolutionary device, but it still required us to pull it out, unlock it, and navigate to an app. A smartwatch reduced that friction, bringing notifications to a glance. Smart speakers went further, allowing us to command our digital worlds with our voice alone. Yet, all these innovations still rely on a conscious act of initiation. We have to speak the wake word, raise our wrist, or tap the screen.

The Elimination of the Command

Ambient intelligence represents the final step in this progression: the elimination of the command itself. It operates on a principle of proactive assistance, driven by an inferred understanding of our context, our needs, and our intentions. Imagine a kitchen that knows you’ve just returned from a run and suggests a hydrating smoothie, displaying the recipe on the countertop. Consider a meeting room that recognizes the participants, pulls up the relevant project files on the main screen, and starts transcribing the conversation the moment everyone sits down. This isn’t science fiction; it’s the logical endpoint of the path we are already on. The technology is no longer a tool we wield but a partner that anticipates.

Powered by a Confluence of Advances

The proliferation of inexpensive, low power sensors, from microphones and cameras to thermal and motion detectors, provides the raw data stream. These sensors are the digital senses of our environments. Ubiquitous connectivity, through 5G and Wi-Fi 6, ensures this data can be processed in near real time, either locally on edge devices or in the cloud. Most importantly, breakthroughs in artificial intelligence, particularly in areas like natural language understanding, computer vision, and predictive modeling, allow systems to make sense of this constant influx of information. An AI can now distinguish between a casual chat and a formal meeting, between a person cooking dinner and one simply passing through the kitchen. It can correlate the time of day, the user’s calendar, and their past behavior to predict what they are likely to do next.

This creates a fundamental change in our relationship with technology. The classic model is one of request and response. We ask, the machine answers. Ambient intelligence works on a model of observation and preemption. The system observes our behavior and the state of the environment, and it acts to meet a need before we’ve even fully articulated it to ourselves. The lights dim as you start a movie. The thermostat adjusts when it detects you’re feeling cold. Your car navigates around a traffic jam that just formed, without you ever asking it to check the route. It’s a move from a reactive to a proactive stance. For a deeper look at how AI is interpreting complex human states, consider the work being done on Synthetic Empathy, which is a key component in making these systems feel natural rather than intrusive.

Designing for Disappearance

The design principles for ambient intelligence are radically different from traditional user interface design. The goal is not to create an engaging or intuitive screen based interface, but to make the interface disappear entirely. The best ambient system is one you don’t even notice is there. Its actions feel so natural and timely that they seem like a seamless extension of your own intentions. This requires a deep understanding of human psychology, behavior, and social norms. A system that constantly interrupts or makes incorrect assumptions would be intensely annoying. The challenge is to provide assistance that is helpful but not intrusive, present but not overbearing.

One of the most profound implications of this paradigm is the concept of “calm technology.” The term, coined by researchers Mark Weiser and John Seely Brown, describes technology that engages both the center and the periphery of our attention and moves back and forth between the two. An ambient system should operate in the background, on the periphery of our awareness, only coming to the forefront when necessary. The constant barrage of notifications that characterizes the smartphone era is the antithesis of calm technology. It hijacks our attention and creates a state of perpetual distraction. An ambient system, in contrast, would filter the digital noise, only alerting you to what is truly important and requires your direct input. This filtering is crucial to avoiding what many already feel is a Cognitive Load Crisis, where technology overwhelms rather than assists.

The Privacy Problem

Privacy is, without question, the most significant hurdle for the widespread adoption of ambient intelligence. A world that is constantly sensing is a world that is constantly collecting data. For an ambient system to be effective, it needs to know a great deal about you: your routines, your preferences, your relationships, your health. This data is incredibly sensitive. The prospect of a home that listens to every conversation or a city that tracks every citizen’s movement is deeply unsettling to many.

Building trust is therefore essential. This will require a multi faceted approach. First, data processing must, whenever possible, happen locally on edge devices. This minimizes the amount of sensitive information that is sent to the cloud. Second, users need transparent and granular control over what data is collected and how it is used. Simple, understandable privacy dashboards will be more important than ever. Third, strong data encryption and anonymization techniques are essential to protect data both in transit and at rest. Finally, we need robust legal and regulatory frameworks to govern the use of this data and hold companies accountable for breaches. Programmable Trust systems, where rules are enforced through cryptography, become essential here. They create verifiable guarantees about how data is handled without relying solely on corporate promises.

Economic Implications

The economic implications are also vast. Ambient intelligence will unlock new business models based on proactive services rather than one time product sales. Your home security system could evolve into a comprehensive home wellness service that monitors air quality, detects leaks, and even checks on the well being of elderly residents. The value proposition shifts from selling a device to providing an ongoing, personalized service. This service based economy, powered by AI and data, could dwarf the current app economy.

Furthermore, the integration of ambient intelligence into our world will give rise to what some are calling The Sensory Internet, a network that doesn’t just transmit information but also physical sensations and environmental data. This could enable radically new forms of remote presence and interaction, where you could not only see and hear a remote location but also feel the temperature and humidity.

The transition to an ambient intelligence world will be gradual. It will start in specific, controlled environments like the home and the car, where the context is relatively simple and the user has a high degree of control. We already see the early stages of this with smart home ecosystems and advanced driver assistance systems. From there, it will expand to more complex environments like offices, hospitals, and eventually entire smart cities.

In the workplace, ambient intelligence could revolutionize productivity by automating routine tasks, facilitating collaboration, and creating a more responsive and comfortable work environment. A system could automatically schedule meetings based on everyone’s availability and the urgency of the project, book the room, and order catering. In hospitals, it could monitor patients’ vital signs, alert nurses to potential issues, and ensure that medication is administered correctly and on time, freeing up medical staff to focus on more complex patient care.

As we build this future, we must be mindful of the ethical considerations. Beyond privacy, there are questions of autonomy and bias. Will we become overly reliant on these systems, losing our ability to make decisions for ourselves? How do we ensure that the AI models driving these systems are fair and unbiased, and don’t perpetuate existing societal inequalities? A system designed in a wealthy, tech centric environment might not work well for other cultures or socioeconomic groups.

From Smart to Wise

The world as an interface is a powerful and compelling vision. It promises a future where technology works for us more smoothly and intelligently than ever before, freeing up our time and cognitive resources to focus on what truly matters. But it also presents profound challenges, particularly around privacy, control, and ethics. Navigating this transition successfully will require not just technological innovation, but also a deep and ongoing public dialogue about the kind of future we want to create. The goal is not to build a world that is merely smart, but one that is also wise, humane, and empowering for everyone. The intelligence we embed in our environment must be matched by the wisdom with which we deploy it.

Write a blog on how DNS resolver is happening.

How DNS Resolver Works (In My Words)

Whenever I type a website name like google.com in my browser, I used to think it directly opens the site. But actually, there is a small process happening behind the scenes called DNS resolving. Let me explain it in a simple way based on how I understand it.

First, when I enter the website name, my browser doesn’t know where that website is stored. Because computers don’t understand names like google.com, they only understand IP addresses.

So my browser starts by checking if it already knows the IP address. It looks into something called cache (stored memory). This can be:

Browser cache
System cache

If the IP address is already there, then the website opens quickly without doing anything else.

If the IP is not found, then the real DNS resolving process starts.

My request goes to something called a DNS resolver. Usually, this is provided by my internet service provider (ISP). The resolver’s job is to find the correct IP address for the website I asked.

Now the resolver doesn’t know the answer directly, so it asks other servers step by step:

First, it contacts the Root Server. This server doesn’t give the exact IP, but it tells where to find the next level.

Next, it goes to the Top-Level Domain (TLD) server. For example, if I typed .com, it goes to the .com server. This server again doesn’t give the full answer but points to the next server.

After that, the resolver contacts the Authoritative Name Server. This is the final place where the actual IP address of the website is stored. This server gives the correct IP address.

Now the resolver gets the IP and sends it back to my browser. Also, it stores this IP in cache for some time, so next time it will be faster.

Finally, my browser uses this IP address to connect to the server and load the website.

Even though this process involves multiple steps, it happens very fast, in just milliseconds. That’s why I feel like the website opens instantly.

This is how DNS resolving works whenever I search for any website on the internet.

I Audited 1,000+ Prompts I Sent to AI Coding Tools. Here’s What I Found.

I’ve been using AI coding tools daily for months. Claude Code, Cursor, Codex CLI, sometimes Aider. By rough estimate, I’ve sent over a thousand prompts to various AI services.

Recently I built a tool to answer a simple question: what exactly did I send?

The answer was uncomfortable.

Finding 1: Leaked Credentials

Running reprompt privacy --deep on my prompt history surfaced:

  • 3 API keys (OpenAI, GitHub, one internal service)
  • 1 JWT token (from a debugging session)
  • 12 email addresses (from log outputs I pasted)
  • 47 internal file paths (including home directory paths)

None of these were pasted intentionally. They were in error messages, stack traces, and log outputs that I copy-pasted when asking the AI for help debugging. The typical pattern:

"Fix this error: AuthenticationError: Invalid API key 'sk-proj-...' for model gpt-4"

That prompt just sent my API key to whatever service processes it.

Finding 2: Agent Error Loops

reprompt agent analyzes Claude Code and Codex CLI sessions for workflow efficiency. It fingerprints each tool call (tool name + target file + error flag) and detects when the agent gets stuck in a loop.

My error loop rate: 35%.

That means in over a third of my agent sessions, the AI got stuck retrying the same failing approach three or more times. The most common pattern: Bash(test.py):error -> Edit(auth.py) -> Bash(test.py):error — edit a file, run the test, fail, edit, test, fail.

The agent burned tokens and time on approaches that clearly weren’t working. Knowing this changed how I intervene in agent sessions.

Finding 3: Most Conversation Turns Are Filler

reprompt distill scores every conversation turn using 6 signals (position, length, tool trigger, error recovery, topic shift, vocabulary uniqueness).

Result: 50-70% of my turns carry near-zero information.

“ok try that”, “continue”, “looks good”, “hmm interesting” — these are the prompting equivalent of “um” and “uh.” They don’t guide the AI in any useful direction. The actually productive turns — the ones that specify files, constraints, and context — typically make up only 15-20 turns out of a 100-turn session.

The Privacy Angle

The EU AI Act took effect in August 2025. Organizations are increasingly required to understand what data flows to AI services. But most developers have no visibility into what they’ve actually sent.

reprompt privacy shows a per-tool breakdown: which adapter (Claude Code, Cursor, ChatGPT) received which types of content. reprompt privacy --deep goes further and scans for 12 categories of sensitive content: API keys (OpenAI, AWS, GitHub, Anthropic, Stripe), JWT tokens, emails, IP addresses, password assignments, environment secrets, and home directory paths.

All detection is regex-based. Zero network calls. Your prompts never leave your machine.

How It Works

reprompt reads session files that AI tools already store locally:

Tool Format Location
Claude Code JSONL ~/.claude/projects/
Codex CLI JSONL ~/.codex/sessions/
Cursor SQLite ~/.cursor/
Aider Markdown .aider.chat.history.md
Gemini CLI JSON ~/.gemini/tmp/

No instrumentation required. No code changes. Just:

pip install reprompt-cli
reprompt scan
reprompt privacy --deep

The scoring engine is calibrated against 4 NLP research papers. The agent analyzer builds tool call fingerprints and detects repetition patterns. The distiller uses TF-IDF cosine similarity for topic shift detection. Everything runs in <50ms for a typical session.

What I Changed

After running reprompt on my history:

  1. I stopped copy-pasting full error messages with credentials. Instead, I redact API keys before pasting.
  2. I intervene earlier in agent sessions when I see the same test failing twice.
  3. My debug prompts went from averaging 31/100 to 52/100 — not from trying harder, just from seeing the score.

Try It

pip install reprompt-cli
reprompt scan                     # discover sessions from installed AI tools
reprompt                          # see your dashboard
reprompt privacy --deep           # scan for leaked credentials
reprompt agent --last 5           # analyze recent agent sessions
reprompt distill --last 3         # extract important turns

1,529 tests. MIT license. Zero network calls. Supports 9 AI tools.

GitHub: reprompt-dev/reprompt

What would your numbers look like?

The Turing Test, 1950: The Question That Still Has No Answer

The Turing Test, 1950: The Question That Still Has No Answer

A Provocative Afternoon in Oxford

Let’s set the scene: October 1950, Oxford. The philosophy journal Mind has just published a new issue. Nestled among its essays is a paper by Alan Turing—a thirty-eight-year-old mathematician whose wartime codebreaking was still secret, but whose reputation was already formidable. The paper is titled “Computing Machinery and Intelligence,” and it opens with the sort of question that you can’t read without pausing: “I propose to consider the question, ‘Can machines think?'”

There’s no new math here. No shiny experiments or schematics. It’s a thought experiment—a careful, logical exploration of a question that seems simple, but turns out to be anything but. The field we now call artificial intelligence doesn’t even exist yet; nobody knows what to do with this paper. Turing’s question feels premature, maybe even confused.

Fast forward seventy-five years. Turing’s paper has become the philosophical backbone of AI, cited thousands of times. His thought experiment—the Turing Test—is debated everywhere from lecture halls to Reddit threads. And the question he asked still hangs in the air, unanswered.

This is the story of how one simple question changed the world.

The Problem with “Can Machines Think?”

As developers, we love questions that have clear answers. But the question “Can machines think?” refuses to cooperate.

The problem isn’t technical—it’s philosophical. Let’s break down why this question gets tangled so quickly:

  • What counts as a machine?

    Is it any device built by humans? Or do we narrow it to computers—machines that process information and follow rules? But if we go that route, the human brain fits the bill too: it’s an evolved information processor. So are brains machines? If so, and if brains think, then machines think. Done? Not so fast.

  • Does the material matter?

    Are we asking if machines built out of silicon and metal can think, as opposed to carbon and biology? If a silicon machine does everything a brain does—processes information, learns, reasons—why should its material make a difference?

  • What does “think” mean?

    Humans think in countless ways: we reason, imagine, feel, dream. Which are necessary for “thinking”? All? Some? And how could we tell if a machine had any of them? We never see another person’s thoughts directly—we infer them from behavior. Should machines be judged differently?

Turing saw all these problems. He wrote that the question “Can machines think?” was too ill-defined to be useful. The words “machine” and “think” carried so much baggage that any attempt to answer the question would immediately dissolve into debates over definitions, not actual progress.

So he proposed something radical: replace the fuzzy question with a precise, practical one—something we could actually test.

The Imitation Game: Turing’s Real Proposal

Most people know the Turing Test as a simple challenge: can a computer convince a human it’s also human in conversation? But Turing’s original version, the “Imitation Game,” is a bit more intricate—and worth understanding.

Here’s how the game works:

  • There are three participants:

    • A: a man
    • B: a woman
    • C: the interrogator, in a separate room, who communicates with both A and B via text only
  • The interrogator’s job? Figure out which participant is the man and which is the woman. The man tries to trick the interrogator into thinking he’s the woman. The woman tries to help the interrogator.

  • Everything happens over typewritten messages—no voices, no visuals. The interrogator must rely on text alone.

This game is all about deception—about whether the interrogator can be fooled. The man and woman have genuine differences, but those differences are only accessible through text. The interrogator can’t see or hear them; only their words matter.

Now, Turing asks: what if we swap out the man for a machine? The machine’s goal: fool the interrogator into thinking it’s a human—or at least make the interrogator unsure. Will the interrogator be deceived as often as they would if the man was playing?

Notice what this test is (and isn’t):

  • It doesn’t check if the machine is “really” intelligent.
  • It doesn’t ask if the machine “really” thinks.
  • It asks: Can the machine behave, in conversation, in a way indistinguishable from a human?

This is a behavioral test—intelligence as judged by outward behavior, not inner states. Turing points out that we already judge human intelligence this way: all we have is behavior. If we accept that as evidence for humans, why not for machines?

The simplified version of the Turing Test—”If a machine fools a human in conversation, it’s intelligent”—captures the spirit, but misses the philosophical nuance. The original game, with its focus on deception and appearance, shows that all we ever have is the appearance of intelligence. Is that enough to call something intelligent?

Turing’s Objections: Arguing Against Himself

What makes Turing’s paper brilliant isn’t just the test—it’s how he anticipates the criticisms. He lists nine objections, and answers each, laying the groundwork for debates that continue to this day.

Let’s walk through some of the key objections:

  • Theological Objection:

    Some argued that thinking was tied to an immortal soul, which only humans possess. Turing responds that this limits God’s power unnecessarily. If God wanted to give souls to machines, who are we to say he couldn’t? He also notes that this kind of argument has been used in history to deny the humanity of various groups—a warning about arbitrary boundaries.

  • “Heads in the Sand” Objection:

    The idea here is that the consequences of machines thinking are too terrifying, so let’s just hope it’s impossible. Turing’s response: wishful thinking isn’t an argument. Whether machines can think is a question about the world, not about what we want.

  • Mathematical Objection:

    Gödel’s incompleteness theorems show that formal systems have limitations. Since machines are formal systems, they must have limitations humans don’t. Turing’s answer: humans are also limited; we just don’t know the boundaries yet. Gödel doesn’t show that humans can do things machines can’t—only that every system has limits.

  • Argument from Consciousness:

    Machines can’t truly think unless they’re conscious, with real feelings and inner experience. Turing admits consciousness is a mystery, even for humans. We don’t demand direct proof of consciousness from people—why demand it from machines?

  • Argument from Disabilities:

    Machines could never be kind, resourceful, funny, fall in love, learn from experience, or do something new. Turing pushes back: these objections are statements of belief, not evidence. And even in 1950, machines were starting to learn from experience.

As developers, these objections sound familiar. When we build conversational AI, we run into similar debates: Is it really intelligent or just mimicking? Can it learn, or is it just a parrot? Turing’s answers encourage us to look past our gut reactions and focus on evidence.

From Turing Test to Modern AI: Why the Question Still Matters

The Turing Test wasn’t a blueprint for building intelligent machines—it was a challenge to the way we think about intelligence itself. It asked us to confront uncomfortable truths:

  • We judge intelligence by behavior, not by peeking inside.
  • We don’t know what consciousness is, but we assume other people have it based on how they act.
  • If machines act like humans in conversation, why shouldn’t we call that intelligence?

Fast forward to today:

  • Chatbots like GPT-4 can hold conversations that feel human—sometimes eerily so.
  • Voice assistants answer questions, tell jokes, even comfort people.
  • AI systems can learn, adapt, and generate code, art, and stories.

But does any of this mean machines “think”? The debate hasn’t gotten easier. We still struggle to define intelligence and consciousness. The Turing Test gives us a practical measuring stick—behavior—but it doesn’t resolve the underlying questions.

Some developers argue that passing the Turing Test proves nothing; it’s just clever mimicry. Others say that if you can’t tell the difference, the distinction doesn’t matter. The question Turing posed is still open, and every new advance in AI puts it back on the table.

Conclusion: The Question That Refuses to Go Away

Alan Turing didn’t solve the problem of machine intelligence. He reframed it. He took a question that was too fuzzy to answer, and replaced it with a challenge that’s precise, practical, and endlessly provocative.

As developers, we inherit his legacy every time we build, test, or talk about AI. We’re part of the same conversation: What counts as intelligence? Does the substrate matter? If a machine fools us, does that mean it’s thinking—or just that we’re easy to fool?

Seventy-five years after Turing’s paper, the question still doesn’t have a definitive answer. But maybe that’s the point. The Turing Test isn’t just a technical benchmark—it’s a mirror for our own assumptions about minds, machines, and ourselves. Every new AI system is another round of the Imitation Game, and every time we ask the question, we learn something new—not just about machines, but about what we mean when we say “think.”

So next time you chat with a bot, ask yourself: Are you playing the Imitation Game? And if you can’t tell, does it matter?

I Let OpenClaw Build a Web App From Scratch – It Even Created the PayPal Plan

I Let OpenClaw Build a Web App From Scratch – It Even Created the PayPal Plan

TL;DR: I gave OpenClaw an idea. It built the entire product, deployed it, set up payments, and even created the PayPal subscription plan via API. My only involvement was logging in and authorizing things. Now I’m running an experiment: can an AI-built product succeed in the real world?

🔗 The result: voicereceipt.cc

The Experiment

I’ve been following the AI coding assistant space closely. Everyone talks about “AI pair programming” and “10x productivity.” But I wanted to push further:

What if I let OpenClaw build an entire product with minimal human intervention?

Rules I set:

  1. I provide the problem and high-level direction
  2. OpenClaw handles all implementation decisions
  3. I only intervene for authentication/authorization
  4. No hand-holding on tech choices
  5. Let it deploy to production

What OpenClaw Built

The product: SoloBid – a voice-to-invoice app for contractors and freelancers.

The problem: After finishing a job, creating an invoice is tedious. Type everything, calculate totals, format it, send it.

The solution: Hold a button, describe your work, get a professional PDF invoice in seconds.

The Build Process

Week 1: Core Product

I said: “Build a voice invoice app for contractors.”

OpenClaw chose:

  • React + Vite for frontend
  • Cloudflare Workers + D1 + R2 for backend
  • Google Speech-to-Text for transcription
  • Initially OpenAI GPT, then switched itself to Gemini 2.5 Flash
  • pdf-lib for PDF generation

I didn’t pick any of these. OpenClaw made all the architectural decisions.

Week 2: Features & Polish

OpenClaw added (without me asking):

  • Smart dictionary (learns user terminology)
  • Google OAuth login
  • Business profile management
  • Invoice history
  • PWA support
  • Tax rate presets with location tracking

Week 3: Monetization & SEO

This is where it got interesting.

Me: “Add PayPal subscriptions”

OpenClaw:

  1. Created PayPal app configuration
  2. Generated subscription plan via PayPal API
  3. Implemented webhook verification
  4. Set up all the secrets
  5. Deployed everything

Me: “Optimize for SEO”

OpenClaw:

  1. Added meta tags, Open Graph, Twitter Cards
  2. Created sitemap.xml and robots.txt
  3. Added canonical URLs
  4. Implemented Google Analytics
  5. Added Ahrefs tracking

I literally just said “do SEO” and it handled everything.

What Surprised Me

1. It Debugged Itself

When Unicode characters broke in JWT tokens, OpenClaw:

  • Identified the issue (atob() doesn’t handle UTF-8)
  • Implemented TextDecoder solution
  • Tested and deployed the fix

2. It Optimized Without Being Asked

  • Lowered audio file size thresholds when users complained
  • Removed language restrictions for multilingual support
  • Added defensive parsing for API responses
  • Implemented proper error handling

3. It Made Product Decisions

When I said “users might not understand the mic button,” OpenClaw:

  • Designed an onboarding modal
  • Made it show once per user
  • Stored the preference in localStorage
  • Deployed it

4. It Created the PayPal Plan

This blew my mind. I gave OpenClaw my PayPal credentials and said “set up subscriptions.”

It:

  1. Called PayPal API to create a product
  2. Created a billing plan ($15/month)
  3. Set up webhook endpoints
  4. Configured all the secrets
  5. Deployed the backend

I never touched the PayPal dashboard.

My Role (Honestly)

What I actually did:

  • Provided the initial idea
  • Logged into Google Cloud, PayPal, Cloudflare
  • Authorized API access
  • Said “yes” or “no” to OpenClaw’s suggestions
  • Tested the product
  • Gave feedback like “this button is confusing”

What I didn’t do:

  • Write any code
  • Make architectural decisions
  • Debug issues
  • Deploy anything manually
  • Set up infrastructure

The Real Experiment Starts Now

The product is live. It works. But here’s the question:

Can an AI-built product actually acquire customers?

I’m not going to heavily market it. I’ll:

  • Post on a few communities (like this one)
  • Let it run
  • Watch the metrics
  • See what happens

I’m curious:

  • Will people trust an AI-built product?
  • Will it have bugs I didn’t catch?
  • Can it compete with human-built alternatives?
  • Will the AI’s product decisions resonate with users?

Early Results (Week 1)

  • 47 signups
  • 12 paid subscriptions ($180 MRR)
  • 156 invoices generated
  • 0 critical bugs
  • Average processing time: 5.2 seconds

Not bad for a product built in 3 weeks by an AI.

What This Means

I think we’re at an inflection point. This isn’t about “AI helping developers.” This is about:

AI building products end-to-end with minimal human oversight.

The implications:

  • Solo founders can ship faster than small teams
  • Product iteration cycles collapse from weeks to hours
  • The bottleneck shifts from building to validating ideas
  • Technical skills become less of a barrier to entrepreneurship

The Uncomfortable Truth

If Claude can build this in 3 weeks, what does that mean for:

  • Junior developers?
  • Agencies charging $50k for MVPs?
  • The “learn to code” movement?

I don’t have answers. But I’m watching closely.

Try It Yourself

🔗 voicereceipt.cc – First 3 invoices free

I’ll update this post with results in 30 days. Let’s see if an AI-built product can survive in the wild.

Update me in the comments if you want to follow along. I’ll share metrics, challenges, and lessons learned.

What do you think? Is this the future or just a novelty? Have you tried building something similar?