Independent security for AI product teams.
Manual security testing for AI agents, LLM applications, and the APIs behind them. I find where permissions and data isolation break, show the impact, and give your engineers practical fixes.
Joshua Bluestine Working with AI teams across the US
01 / Credentials & research
Work directly with the person testing your product.
Real AI security research, accountable findings, fixes your engineers can ship.
Founder · AI & application security researcher
I bring a developer’s perspective to security testing: follow the data, question what the agent is allowed to do, and make the fix usable for the engineer who owns it.
LLM & agent security · API & backend integrations · Python automation
View GitHub profileCVE-2026-49950
I reported unauthenticated access to actor control functions. The maintainers included that report in their combined advisory and credit me as a reporter.
Read the maintainer advisoryAn unauthenticated peer reaching an exposed actor-pool port could request configuration and topology information or stop a pool. Application login did not protect this separate internal transport.
Xoscar 0.12.0 introduced opt-in actor-transport authentication with XOSCAR_AUTH_KEY. A strong, nonempty key must be configured on communicating processes, and actor ports must be restricted to intended peers. An unset or empty key retains unauthenticated behavior; upgrading alone does not enable the protection.
The advisory combines multiple reports. Its critical rating and title concern a separate deserialization issue. My credited contribution is the related unauthenticated control-plane exposure.
Read the full research note →These examples come from intentionally vulnerable applications, not customer engagements. They show how I connect a finding to its impact and a practical fix.
What gets tested
A working demo is only the beginning. I test the agents, APIs, and access rules behind the product your customers are trusting with their data.
Prompt injection, private retrieval, and tool permissions. I test whether untrusted input can push your agent into data or actions it was never meant to reach.
AI & LLM testing scope →Accounts, roles, tenant isolation, files, and exports. I check whether one customer can read or change another customer’s data.
Authorization, session changes, and workflows run out of order. I look for actions the interface hides but the API still allows.
SaaS & API review scope →02 / The approach
We agree on the boundaries.
I test them, explain what breaks,
and check the fix.
We choose the application, roles, test accounts, and priority workflows. You get a written scope and a fixed quote before testing starts.
YOU GET An agreed testing scopeI work through the product role by role, following requests and checking what each user should be able to do. Tools support the work; manual investigation follows the important questions.
THE FOCUS Permissions, data, and business logicEach confirmed finding includes reproduction steps, evidence, impact, and a recommended fix. The report also explains the areas covered and the limits of the review.
YOU GET A prioritized report for your developersAfter your team patches an issue, I repeat the relevant tests and document the result. A one-time review includes one retest of the agreed fixes.
YOU GET Evidence that the original issue is closedThe deliverable
Your engineers get the detail. Your customers get a clear account of the work.
A record of the agreed application, roles and workflows, plus a plain-language summary letter you can share with customers. Coverage and limitations are explicit.
Confirmed findings include reproduction steps, evidence, impact and recommended fixes. Priorities reflect the effect on your product and users.
One retest is included in a one-time review. I repeat the relevant checks and document whether the original issue is resolved.
Fictional example. It shows the format and level of detail, not a client engagement.
03 / Testing plans
Built for startups taking an AI product to real customers.
We agree on the scope and price before work begins.
The core engagement
A manual penetration test of one AI agent, LLM feature or web application, and the APIs behind it. Hands-on testing, not an automated scan.
Review plus hands-on help
A security review with implementation of specifically agreed fixes. Final price depends on remediation scope.
After your initial review
Up to eight hours of testing each month, focused on what you shipped and your security priorities.
Founding-client rate: my first three clients get the Security Review for $1,500, in exchange for permission to publish an anonymized case study they approve first. Ask about availability.
Not ready for a full review? A $500 scoping session maps your agent’s tools, data and top risks, with a written summary. The fee is credited toward a Security Review booked within 30 days. Request a scoping session.
Before we talk
The essentials for deciding whether a conversation makes sense.
Book a 15-min intro callThis is for startups bringing AI agents, LLM features or SaaS products to customers. A useful starting point is a working application with test accounts, especially before a launch, a customer review or a significant change to permissions.
The Security Review is a manual penetration test of one agreed AI agent, LLM feature or application, priced at $2,000. It includes documented findings, remediation guidance, a summary letter, a results call and one retest. My first three clients pay a founding rate of $1,500 in exchange for permission to publish an anonymized case study. Review + Fix starts at $3,000; the final price depends on the agreed remediation scope. Ongoing Security Support is $1,000 per month after an initial review, with up to eight hours monthly across selected change reviews, targeted testing, fix verification and consultation. A $500 scoping session is credited toward a Security Review booked within 30 days. Larger work is quoted separately. We agree on scope and price before work begins.
Timing depends on your application, the roles and workflows in scope, and availability. We agree on the testing window before starting. Prepare a product overview, your priorities and any customer deadline; test accounts and access are arranged after scope and authorization are agreed.
Agent tool permissions, retrieval of private data, API authorization, tenant isolation and business logic. The question is whether an input can cross a real access or data boundary. The exact checks depend on your product and the written scope.
You receive a plain-language summary letter as well as the technical report. Share your customer’s requirements before we agree the scope so we can check fit. Each customer decides what evidence they accept; this review is not a compliance certification or a guarantee that the application is free of vulnerabilities.
Every confirmed finding includes remediation guidance, and a Security Review includes one retest of the agreed fixes. Choose Review + Fix for implementation of specifically agreed fixes. Ongoing Security Support can cover selected change reviews, targeted testing, fix verification and consultation within its eight-hour monthly allowance; larger work is quoted separately.
We discuss what you’re building, the data and actions it handles, your priorities and timing. If there’s a fit, the next step is a written scope and quote. You do not need to bring credentials, customer data or a finished security questionnaire to the call.
Before your customers ask
Book a 15-minute intro call to discuss your product, priorities and timing. Prefer to start in writing? Send the overview here and I’ll reply personally.
We clarify the work, agree on a scope and quote, and choose a testing window.
Prefer email? jbluestine@bluejayappsec.com
