Secure the AI in your code in 24 days, ten minutes at a time
A daily email challenge for developers. Every day brings one small task in your own repository and one concrete result. By Christmas Eve you know where AI lives in your code, what can go wrong with it, and what to fix first.
Starts 1 December 2026. One email a day. Unsubscribe whenever you like.
-->
What you’ll have by 24 December
A clear picture of your AI footprint
Every model, prompt, API key, data source and dependency that touches AI in your repo, written down in one place. Most teams discover at least one thing they didn’t know was there.
The ability to say what could actually go wrong
Not a generic list of scary headlines. A risk view matched to how your system really uses AI, from a simple chat call to an agent with tools and permissions.
A threat model you built yourself
You apply two modern approaches, AGENTIC and MAESTRO, to your own system and see what each one catches. You can run the exercise again with your team next quarter.
Fixes you can ship
The OWASP Top 10 stops being a slide and becomes a checklist against your code. You finish with a short, prioritised list of what to fix first and why.
A habit that fits a real workday
Each task is built to take 5 to 10 minutes. No weekend project, no certification track, no reading backlog. Small steps, each one leaving something useful behind.
What a single day looks like
- An email arrives.Short, a bit of humor, and an example or analogy that makes the risk stick.
- You do one task in your own repo.Five to ten minutes, no special tooling, any language or stack.
- You end with a result.A list, a diagram, a decision. Something you keep and build on the next day.
Quick question. If your support bot could talk, what would it admit to having read? Customer names? Invoices? That one stack trace someone pasted with a production token still in it?
Today we find out before someone else does.
A sample day, shortened. The real emails are a little longer and a little funnier.
Before and after the 24 days
“We use AI somewhere in the product, I think.”
A written inventory of every model, prompt, data source and dependency, each with an owner.
“I assume the data is fine.”
You know which sensitive data can reach which model, and where it shouldn’t.
“Security asked if this is safe. I said probably.”
A clear answer for each AI feature: what can go wrong, how likely it is, and what it would cost.
A long list of generic AI risks and no idea where to start.
A short, prioritised list of fixes, ordered by impact on your own system.
Every conversation about AI risk starts from zero.
A threat-modeling routine your team can run again for the next feature.
Is this for you?
It will suit you if
- You write or review code that calls LLMs, uses RAG, or runs agents.
- You’re asked “is this safe?” and want an answer based on your own system.
- You’re not a security specialist and don’t want to become one overnight.
- You lead a team and want a shared starting point for AI security.
It’s probably not for you if
- You want a deep dive into adversarial ML research and the math behind it.
- You’re looking for a certification or a formal course with exams.
- You expect a tool that scans your code for you. Here, you do the looking, and that’s where the learning happens.
Who’s behind it
-->
Adrian Sroka
AI Security Lead · Warsaw, Poland
I’ve spent my career as a security architect and consultant in product companies, building DevSecOps, MLSecOps and secure SDLC programs, running Security Champions networks and teaching teams to threat model. Today I lead AI security and work with companies on both sides of the problem: how their people use AI, and how their own models and fine-tuned LLMs stay safe.
I hold an M.Sc. in Computer Science with a specialisation in AI from Warsaw University of Technology, and I created AGENTIC, a method for analysing the risks of AI agents. This calendar is the same material I teach in workshops, cut into pieces small enough to do before lunch.
Questions you might have
How much time does it take?
Each day is designed for 5 to 10 minutes. Some days you’ll want to linger, and that’s fine, the tasks wait for you.
Do I need a security background?
No. The first days are about looking at what you already have, and every concept is explained before you use it. If you can read your own repository, you can do this.
Which languages and frameworks does it cover?
All of them. The tasks are about your architecture, data and permissions, not about one library. Python, TypeScript, Java, Go or something else, it works the same.
What if I miss a day?
The emails stay in your inbox, so you can catch up whenever it suits you. Each task builds on the previous result, so it’s worth finishing in order.
Can my team do it together?
Yes, and it works well. Everyone signs up with their own address, you compare results over coffee, and you end with a shared view of your AI risks.
What happens to my email address?
It’s used only to send you the challenge emails. You can unsubscribe with one click in any message.
Start with one small task
Join the challenge and get Day 1 on 1 December 2026. By Christmas Eve, you’ll know your AI better than most teams ever do.