AI red teaming in CI/CD
Promptfoo-based red team testing integrated into GitHub Actions, mapping security testing to the OWASP LLM Top 10 and MITRE ATLAS.
GitHub
Write-up
Secure AI adoption starts before deployment.
I’m Jeff Karanja — an Application Security, DevSecOps, and AI Security specialist. I focus on secure-by-design engineering, application security testing, AI red teaming, and delivery pipelines that make security repeatable.
Application Security · DevSecOps · AI Security
Where I work
Application Security
DevSecOps
Secure by Design
Threat Modeling
API Security
AI Red Teaming
CI/CD Security
Security Training
- System
- ai-support-agent
- Standard
- OWASP LLM Top 10
- Frameworks
- MITRE ATLAS
- Checks run
- 14
- Critical
- 2
- Mitigated
- 12
Pipeline 8f3c7e0
Completed 00:42
How I think about delivery
Security is a path, not a gate at the end. The work moves with the feature — modeled early, tested like an attacker, and enforced in the pipeline so a secure release is the default outcome.
What I work on
Security that fits how engineers build and ship.
01
Secure AI delivery
Helping teams embed AI-security checks into product engineering and CI/CD workflows.
02
AI red teaming
Testing LLM and agentic systems for prompt injection, unsafe tool use, data exposure, and control failures.
03
Application and API security
Threat modeling, secure design reviews, SAST, SCA, DAST, API testing, and vulnerability remediation.
04
DevSecOps enablement
Turning security requirements into engineering workflows, guardrails, and measurable controls.
Featured work
Work in the open, labeled honestly.
From API pentesting to LLM attacks
A practical methodology connecting traditional API security testing with LLM attack paths — PortSwigger LLM labs, Burp Suite workflows, and OWASP mappings.
Write-up
GitHub
OWASP LLM Top 10, explained for builders
Plain-language security notes that translate the OWASP LLM risks for engineers and product teams.
Write-up
Hands-on mobile app security with mobile DevSecOps
EC-Council course author work focused on practical mobile security and secure delivery practices.
Video
Course
AI security focus
How my AI security work maps out.
I document the work, not only the outcome. My AI-security lab covers OWASP LLM risks, prompt injection, LLM testing, AI red teaming, secure agent design, and automated controls in CI/CD.
-
Foundations
OWASP LLM Top 10, MITRE ATLAS, AI threat modeling
-
Prompt injection
Gandalf, HackAPrompt, Arcanum taxonomy
-
Web & API-to-LLM testing
PortSwigger LLM labs, Burp Suite
-
Automation
Promptfoo, GitHub Actions, Garak, PyRIT
-
Next
Agentic AI security, AI supply chain, offensive AI testing
Building secure systems for the AI era.
I work across application security, DevSecOps, and AI security — bringing secure-by-design engineering into the systems teams ship next. Follow the work or start a conversation.