Hardening Site Security with Jev Typesafe AI and Antigravity

Summary: Jev Typesafe AI is an independent security auditor agent that works alongside Google Antigravity (AGY). In this post, I explain how Jev works and the steps we took with Antigravity agents to tighten the security of this site (ozanozdil.com).

1. What Is Jev Typesafe AI?

Jev Typesafe AI is an artificial intelligence architecture based on type safety and state determinism, positioned directly within the software development cycle as an autonomous and independent "Chief Security Auditor."

While traditional security tools (SAST/DAST) generally rely on static rules or signature-based scans, Jev Typesafe AI perceives the context of the code, the execution environment, the network topology and cloud (Cloudflare Workers etc.) constraints as a logical whole. It has deterministic execution safeguards and verification shields to prevent model hallucinations and to make "type-safe" decisions.

What Can It Do?

• Autonomous Code Audit and Vulnerability Analysis: When Jev is included in a project, it examines the entire source code tree, configuration files (wrangler.toml, astro.config, robots.txt) and dependencies, and detects critical vulnerabilities such as XSS, Path Traversal, IP Spoofing and configuration disclosure.
• Designing LLM and Prompt Injection Shields: At the artificial intelligence endpoints integrated into the system, it builds heuristic and static filters to prevent incoming user data from poisoning the model (Jailbreak, System Prompt Leakage).
• Applying Zero Trust and Defense-in-Depth: It integrates the philosophy of "trust no one" into applications. It classifies all incoming HTTP headers (Origin, Referer, X-Forwarded-For) as potential vectors open to manipulation and isolates the trustworthy ones (such as Cloudflare cf-connecting-ip).
• Fail-Closed Architecture Integration: When a service in the system (for example, the KV database or Rate Limiter) crashes, it ensures that traffic is stopped entirely (fail-closed), preventing attackers from exploiting capacity overruns (fail-open).

2. ozanozdil.com Hardening Operation with Antigravity and Jev

To tighten the site's security, we ran the Google Antigravity agent (implementer) and the Jev Typesafe AI agent (independent auditor) together.

The hardening steps carried out through the mutual communication of the autonomous agents and the direction of the system administrator (the user) are summarized below in technical context:

A. Closing information disclosure

Jev's first finding was that the robots.txt file listed the names of directories that should not be published. These lines were removed and requests to these directories were blocked on the server side.

B. Tightening HTTP and CSP headers

• Elimination of 'unsafe-eval': In line with Jev's report, 'unsafe-eval' was removed from the Content-Security-Policy (CSP) headers in the Cloudflare Worker.
• Isolation: The object-src 'none', frame-ancestors 'none' and upgrade-insecure-requests directives were enabled.
• Strict Headers: X-Frame-Options: DENY, Cross-Origin-Opener-Policy: same-origin and an expanded 20-parameter Permissions-Policy that blocks hardware API access are in effect.

C. Advanced IP Spoofing and Rate Limiting (Fail-Closed)

The x-forwarded-for header, which can be sent by the user, was revoked, and the cryptographically protected cf-connecting-ip header at the network edge was accepted as the only correct source. The distributed KV-based rate limiter at the /api/chat and /api/views endpoints was moved from a fail-open position to a fail-closed position that cuts all traffic with a 503 response in the event of an error.

D. Prompt Injection and Protocol-Relative Bypass Protection

• Static shields were written for protocol-relative redirect vulnerabilities that could occur in Markdown URL data sent to the system (e.g. //evil.com).
• A "Pre-flight" pre-cache check was added against model manipulations (ignore instructions, dan mode) in messages sent to the artificial intelligence chat assistant. Input data was subjected to strict length and character checks.

E. Removal of emojis

Antigravity cleaned the emojis from the code, documentation and interface files; the interface was left with plain typography.

3. Optimization for Artificial Intelligence Agents and Search Engines (LLM-SEO)

Jev Typesafe AI is not only an auditing mechanism; it ensures that the code created by autonomous agents can be easily discovered by other autonomous building blocks (LLM SEO). In our architecture, structures such as API documentation and model contexts (/llms.txt, /.well-known/api-catalog) are optimized directly for agent-to-agent communication.

This post is also published as plain Markdown so that search engines and RAG (Retrieval-Augmented Generation) bots can easily read it.

My reading

Including independent autonomous auditors like Jev Typesafe AI and integrator agents like Google Antigravity in the software development process helps catch configuration errors that static scans miss. This work on ozanozdil.com showed that, under human supervision, agents can complement each other and produce useful results.