Product Security Playbook
A practical product security playbook covering architecture, identity, threat modeling, delivery controls, and customer trust.
Jeff Karanja
I bring security into
what ships next.
I help teams design, test, and ship secure systems. My work spans Application Security, DevSecOps, and AI Security.
Where I work
Application Security
DevSecOps
Secure by Design
Threat Modeling
API Security
AI Red Teaming
CI/CD Security
Security Training
- System
- ai-support-agent
- Standard
- OWASP LLM Top 10
- Frameworks
- MITRE ATLAS
- Checks run
- 14
- Critical
- 2
- Mitigated
- 12
Pipeline 8f3c7e0
Completed 00:42
How I think about delivery
Security is a path, not a gate at the end. The work moves with the feature — modeled early, tested like an attacker, and enforced in the pipeline so a secure release is the default outcome.
What I work on
Security that fits how engineers build and ship.
01
Secure AI delivery
Helping teams embed AI-security checks into product engineering and CI/CD workflows.
02
AI red teaming
Testing LLM and agentic systems for prompt injection, unsafe tool use, data exposure, and control failures.
03
Application and API security
Threat modeling, secure design reviews, SAST, SCA, DAST, API testing, and vulnerability remediation.
04
DevSecOps enablement
Turning security requirements into engineering workflows, guardrails, and measurable controls.
Featured work
Work in the open, labeled honestly.
Hands-on mobile app security with mobile DevSecOps
EC-Council course author work focused on practical mobile security and secure delivery practices.
ChatGPT for Security Audit
EC-Council course author work focused on using ChatGPT for security audits, log analysis, and compliance reporting.
ISACA IT Specialist Audit: Auditing Cloud Environments
Completed ISACA Kenya Chapter training in auditing cloud environments, assessing cloud risks, and evaluating security and governance controls.
AI red teaming in CI/CD
Promptfoo-based red team testing integrated into GitHub Actions, mapping security testing to the OWASP LLM Top 10 and MITRE ATLAS.
GitHub
Write-up
From API pentesting to LLM attacks
A practical methodology connecting traditional API security testing with LLM attack paths — PortSwigger LLM labs, Burp Suite workflows, and OWASP mappings.
Write-up
GitHub
OWASP LLM Top 10, explained for builders
Plain-language security notes that translate the OWASP LLM risks for engineers and product teams.
Write-up
AI security focus
How my AI security work maps out.
I document the work, not only the outcome. My AI-security lab covers OWASP LLM risks, prompt injection, LLM testing, AI red teaming, secure agent design, and automated controls in CI/CD.
-
Foundations
OWASP LLM Top 10, MITRE ATLAS, AI threat modeling
-
Prompt injection
Gandalf, HackAPrompt, Arcanum taxonomy
-
Web & API-to-LLM testing
PortSwigger LLM labs, Burp Suite
-
Automation
Promptfoo, GitHub Actions, Garak, PyRIT
-
Next
Agentic AI security, AI supply chain, offensive AI testing
Building secure systems for the AI era.
I work across application security, DevSecOps, and AI security — bringing secure-by-design engineering into the systems teams ship next. Follow the work or start a conversation.