AI-Feature AppSec Sprint | Ahmed Andaloes

What You Get

The AI-Feature AppSec Sprint is a structured security review of one named AI feature, delivered by Ahmed Andaloes. It provides advisory findings on security risks through threat modeling and systematic checklist-based assessment.

Advisory review, not certification. This is a point-in-time assessment that identifies security risks and provides actionable recommendations. It does not certify, audit, or provide pass/fail verdicts.

Who this is for: Teams shipping LLM-powered features or autonomous agent capabilities who need external security guidance on AI-specific risks before or during deployment.

Review Focus Areas

Prompt Injection

Direct and indirect injection vulnerabilities

Tool Permission Abuse

Authorization on AI-driven actions and tool calls

Sensitive Data Exposure

PII handling in prompts, logs, and third-party transmission

Authorization

User identity propagation and permission enforcement

Service Boundaries

What This Is

External security review of one named AI feature
Time-boxed engagement with explicit hour/day cap
Advisory findings with actionable recommendations
Defensive approach using checklists and threat modeling

What This Is Not

Pass/fail certification or regulatory compliance attestation
Penetration test or exploit development
Ongoing monitoring or continuous assessment
Implementation services (client owns remediation decisions)

Engagement Process & Length

Intake — Define scope, time cap, and access requirements
Threat Modeling — Map architecture, trust boundaries, and attack surface
Security Review — Systematic checklist-based assessment
Findings Report — Severity-rated findings with recommendations
Delivery — Final report with "Fix These First" priorities

Typical Engagement Length

Half-day (4 hours) — Focused review of one narrow AI feature
Full-day (8 hours) — Comprehensive review with threat modeling
Custom — Scoped to feature complexity (change orders for expansion)

Deliverables

Each engagement produces structured artifacts for your team:

Intake & Scope Documentation

Documented scope, feature boundaries, time cap, and access requirements

Threat Model

Architecture mapping, trust boundaries, attack surface analysis, and threat scenarios

Findings Report

Severity-rated findings (Critical/High/Medium/Low) with impact analysis and actionable recommendations

"Fix These First" Priorities

Top 3-5 critical/high findings prioritized for immediate remediation

See an example: Try the interactive Sprint Kit demo or view a complete demo engagement showing intake form, threat model, and findings report for a fictional AI feature.

Try the Demo or Start an Engagement

Explore the Sprint Kit workspace or connect with Ahmed to discuss a custom engagement.

Try the demo workspace Start an engagement

How Reviews Are Delivered

Engagements are conducted using a local-first CLI toolkit that structures the review process. The toolkit includes security checklists, threat model templates, and report generation for consistent, thorough assessments.

Practitioner Toolkit (Open Source)

The delivery kit is open source and available on GitHub. It's designed for practitioners conducting AI security reviews, not as a self-serve DIY tool.

View toolkit on GitHub | Read documentation

Toolkit Overview

# Install dependencies
pip install pyyaml

# Initialize a new engagement
python -m sprint init client-feature

# Run interactive intake
python -m sprint intake client-feature

# Generate findings report
python -m sprint report client-feature

Resources

Full README — Complete documentation and usage examples
Methodology Guide — Detailed review process and best practices
Security Checklists — AI-specific security review checklists
Demo Engagement — Example report and engagement artifacts