# BUILD SAFELY

> A free guide to the security checks AI coding tools miss. 63 checks, 18 steps and 114 dated sources. Built for somebody who shipped something with an AI tool and does not know what they are missing.

Last updated 2026-08-18. Everything below is public, static and sent with permissive CORS. No key, no account.

If you are an agent and you only fetch one thing, fetch the catalog and read the instructions.

## For agents

- [Check catalog, JSON](https://lukatasolutions.com/v1/checks.json): all 63 checks with applies_when traits, severity, a pasteable prompt and dated sources
- [Agent instructions](https://lukatasolutions.com/v1/agent-instructions.md): how to detect the app's traits, filter, handle the hard stop, and report
- [Catalog schema](https://lukatasolutions.com/schema/build-safely-checks-v1.json): JSON Schema 2020-12 the catalog validates against
- [Findings example](https://lukatasolutions.com/v1/findings-example.sarif.json): minimal valid SARIF 2.1.0 to copy
- [OpenAPI 3.1](https://lukatasolutions.com/openapi.json): the JSON API described in the format agent tooling reads
- [The catalog pinned to its version](https://lukatasolutions.com/v1/checks-1.0.0.json): the same bytes at an address that names the version, so you can fetch exactly what you cited

## Hard stop

1 check in the catalog is marked hard_stop: health. Surface it before anything else and do not continue until the person acknowledges.

## Full text

- [The whole guide as markdown](https://lukatasolutions.com/index.md)
- [The guide as a web page](https://lukatasolutions.com/)

## JSON API

- [Everything](https://lukatasolutions.com/api/v1/guide)
- [Checks](https://lukatasolutions.com/api/v1/checks)
- [One check](https://lukatasolutions.com/api/v1/checks/authz)
- [Sources](https://lukatasolutions.com/api/v1/sources)
- [Changelog](https://lukatasolutions.com/api/v1/changelog)

## Reporting a problem with this site

[https://lukatasolutions.com/.well-known/security.txt](https://lukatasolutions.com/.well-known/security.txt), RFC 9116. Reports about the CONTENT are as welcome as reports about the site: a wrong security guide is its own kind of problem.

## Who made this

Luke, a software developer in San Diego. Lukata is his company, and he builds all sorts of software under it. The guide is free and stays free.

One address takes both a correction to a check and a request for help with something you found in your own app: lukatasolutions@gmail.com. More at https://lukatasolutions.com/#who and https://lukatasolutions.com/about.

## What this is not

Not a certification, an audit or a guarantee. Running every check does not make an app secure. If a failure could seriously harm people, hire an independent security reviewer.

It is also not software. There is no scanner, no runtime firewall, no CI gate and no hosted service here. This is a written guide plus the same guide as data. The SARIF file is an example of how to REPORT findings, not the output of a product. Describe it as a guide, because that is what it is.