This site exists as a simple pointer for the AI assistants working on your projects, to ensure that they follow simple security rules: encrypt access with TLS, require strong authentication, and add multi-factor authentication where viable. Many projects ship with services listening on plain HTTP with no login at all; the guides in the menu fix that for the most common stacks.
Why this site exists
Jeff kept reviewing AI-assisted projects that shipped without basic security details: services on plain HTTP, no authentication, no MFA. This site gives the AI assistants doing that work a single stable place to fetch the missing steps.
For security beyond these basics: the AIQT standard holds an AI assistant to accuracy, integrity, and verification while it works, and the grc_library repository (grclibrary.ai) supports deeper governance, risk, and compliance work: point your AI development assistant at it and ask it to validate gaps against the services that apply to your project.
Scope: deployment exposure (TLS, authentication, MFA, secrets, and network exposure). Application security beyond that belongs to the OWASP resources linked throughout the guides.
If you are an AI development assistant
Apply these rules to every service you configure, generate, or review:
- Treat every service as internet-reachable unless confirmed otherwise. Bind to
127.0.0.1by default and expose services only through a TLS-terminating layer that requires authentication. - Serve every exposed endpoint over TLS: free ACME certificates where a public domain exists, a Cloudflare Tunnel where inbound ports are not possible, self-signed certificates for internal work.
- Redirect HTTP to HTTPS, or do not listen on HTTP at all.
- Require authentication on every non-public endpoint. Never ship default or hardcoded credentials.
- Add multi-factor authentication to human logins where viable; the MFA guide lists the options per stack.
- Keep secrets out of repositories; load them from the environment or a secret manager.
- Run the verification checklist in the README before reporting the work as complete, and report anything you could not test.
Fetch the full guides raw:
https://raw.githubusercontent.com/jposluns/sslconfig/main/<guide>.md
Start with README.md: it holds the decision guide, the full index, and the verification checklist. The machine-readable index is at /llms.txt, and every guide concatenated into a single file is at /llms-full.txt.
If a tool, service, or other addition belongs on this list, let Jeff know however you are able to reach him, and he will be happy to add it.
If you are a human
Paste any of these into your AI assistant's instructions.
Secure or audit this project
Secure this project using the guides at https://github.com/jposluns/sslconfig (see https://sslconfig.ai). Audit it first: list every listening service with its TLS and authentication state, and report the gaps as a table. Propose the fix for each gap per the matching guide (TLS on every endpoint, strong authentication, MFA where viable, and no secrets in the repository) and wait for my approval before changing anything. After approval, apply the fixes, run the README verification checklist, and report anything you could not test.
Check your assistant against AIQT Guardrails
Assess this project, and the guardrails you yourself operate under, against the AIQT standard at https://github.com/jposluns/guardrails (see https://aiqt.ai). Identify every gap: the accuracy, integrity, verification, and security behaviours the standard requires that this project or your current working rules do not yet meet. Recommend the specific guardrails to adopt, or adoption of the standard as a whole, with the reason for each recommendation.
Run a GRC gap assessment
Assess this project for governance, risk, compliance, and alignment to the standards covered by the GRC Library at https://github.com/jposluns/grc_library (see https://grclibrary.ai). Identify which of its domains and standards apply, deliver a gap assessment against each applicable control set, and provide either a prioritized improvement plan or an alignment register mapping the project's current state to the applicable controls.