From the Backlog to the Build Log

An AI Security Review Five Months Later: November 6 - November 12, 2026

What I Worked On

Back in June, when Fable 5 came out, I had DevNitro use it for a full security audit of DevNitro's own code. Fable 5.2 came out Monday, so late that night I added it to DevNitro and had it run an AI security review against that audit, to see what still held up five months later and what was new. Going back to old findings instead of trusting they stayed fixed is the kind of work Intelligent Engineering should make routine.

I also added a new general-purpose agent that night. The rest of the week went to the fixes, three deploys, a failed deploy that had nothing to do with the code, and video work.

What the AI Did Well

Fable 5.2 split the review across three read-only sub-agents running in parallel. One checked each of June's findings against today's code, one went through the Dapper data layer looking for SQL built from interpolated strings, and one checked June's secret scan against the working tree.

Some of June's findings had been fixed since, and others were still open. The one I'd point other .NET developers to is the shell tool's working-directory check, which used StartsWith on the path. That looks fine until you notice that C:\repo-old starts with C:\repo. It now uses a real containment check, with tests. By 6 PM Tuesday, DevNitro had closed a batch of findings across sign-in and secrets, access between tenants, URL fetching, and input handling.

Earlier in that session, I asked for a general-purpose agent to sit beside the C#, xUnit, SQL, and Dapper specialists for work that fits none of them. DevNitro followed the existing pattern for built-in agents and had the spawn tools suggest the new one when no specialist fits. It also pointed the names a model tends to guess, like general-purpose and default, at general.

What Needed Correction

Tuesday night's deploy failed before it built anything. The preflight gate, which builds the app on my machine with the Dockerfile's flags, couldn't find a file from .NET SDK 10.0.403. An update that afternoon had replaced that SDK with 10.0.404.

Fortunately, a dotnet restore from a fresh shell fixed it. The offline preflight check, which deploys nothing, passed, and I deployed that night.

The bell that should ring when a turn finishes never rang, either. It wrote to Console.Out, which the native chat UI captures into its log, so the sound never reached the terminal. It goes through the UI's terminal now.

A smaller fix went into GCT. File-based apps, the ones you run with dotnet run file.cs, default to PublishAot=true, which pulls in the AOT compiler at the SDK's bundled version, and NuGet audit flags it as NU1903 when that version lags a security patch. GCT's build scripts never get AOT-published, so they now set PublishAot=false. After a NuGet audit warning blocked a deploy in September, I'd rather drop a dependency I don't use.

What Shipped

Friday I moved GCT, BlankSite, Lobast, and DevNitro to GlobalCove 2.3.6 and the 10.0.14 .NET packages, rebuilt the BlankSite blueprint, deployed, and started a website for Lobast.

I deployed DevNitro again Tuesday night with Fable 5.2, the general agent, and the security fixes. Thursday night's deploy added a warning for a pending OS restart. Windows can restart on its own after an update installs, which stops every running agent, so the CLI, the listener, and the web UI now warn you when one is pending.

Wednesday night I published "AI Can Fake Your CEO's Voice. Would Your Team Wire the Money?" on HowdyChad. My AI video studio rendered it, including a short music video at the end.

In the Studio

The studio had 37 commits this week. Monday morning I found Sunday night's job still running because one agent was stuck on a scene. By midweek, an overnight job split a 3D scene into pieces so four agents could build them in parallel from written briefs.

One fix is worth passing on. When the studio's C# core wrote to a pipe, .NET used the console code page, so characters like "·" and "α" came out mangled unless the caller ran chcp 65001 first. The core now uses UTF-8 whenever its input or output is redirected.

The Numbers

Category Hours
Content 36h 53m
Business 7h 39m
Product / Features 4h 14m
Testing 4h 8m
Deploy / Infra 3h 24m
Total 56h 19m

DevNitro product work (features, tests, and deploys) came to 11h 46m, about three times last week's 3h 56m. Go-to-market fell from 26h 19m to 7h 39m, mostly keeping last week's outreach going, and 9h 10m of the content time went to the studio.

Where This Fits in Intelligent Engineering

One finding still open from June was that a sub-agent's tool filter replaced its parent's filter instead of narrowing it, so handing work to a sub-agent could widen what was allowed. Now a sub-agent starts from its parent's limits and can only shrink them. Intelligent Engineering puts limits like that in the code that runs the agents, where a prompt can't talk its way past them. Going back to check them is how you find the ones still open.

That's the week: Fable 5.2 ran an AI security review against June's audit, and a failed deploy came down to a Visual Studio window left open. If you want to see DevNitro in action, grab a spot on my calendar and I'll give you the tour. If you want help getting more out of the AI tools your team already uses, I can help with that too.