A note about this build log entry: I published this after the week it covers. DevNitro reconstructed a draft from work-related entries in my journal, Git commit history, and time tracking. I reviewed, edited, and approved the final post. The story reflects what I knew and built at the time.

From the Backlog to the Build Log

Week of June 5 - June 11, 2026

What I Worked On

The big one this week: I had DevNitro run a real security audit on the framework, and then fix what it found. The Fable 5 model was released this week, so I ran all of my code through the paces having Fable scrutinize everything. This is the clearest case I have for Intelligent Engineering: the boring, critical work an organization never has a free week for, run as a governed job instead of a hopeful prompt.

This was not a chat asking "is my code secure?" It was a planned security epic with a threat model, then dozens of tracked findings worked through one by one. The list is long and specific: SSRF allow-lists with fail-closed template rendering, path-traversal and filename sanitizers, an SVG sanitizer and magic-byte content-type checks to stop stored XSS, IDOR and authorization hardening, anti-forgery on every cookie-authenticated state-changing endpoint, a strict nonce-based Content-Security-Policy, and PII scrubbing in logs. It ran secret scanning over the full git history, produced a software bill of materials and a supply-chain audit, and finished with a consolidated findings report, a risk register, and a remediation roadmap.

My favorite fix: there was a merge-template engine that used Roslyn to compile expressions at runtime, which is a fancy way of saying arbitrary code execution by design. I had it replaced with an allow-list evaluator that treats data as typed parameters and cannot execute code by construction. That is not a patch. That is removing the whole category of vulnerability.

The second feature was more fun: voice. You can now talk to DevNitro. I built an ITranscriptionService on a managed Whisper.net engine, no Python dependency, with a runtime that lazy-downloads and verifies itself, and wired microphone input into every surface: the CLI through NAudio, the web UI with an in-browser recorder, and the VS extension, all sharing one transcription core over the relay. The model isn't the best, so I'll revisit this later, but it is a start. I still use Windows Key + H to bring up the built-in Windows dictation, but now I can also use the built-in DevNitro voice command to do the same thing.

What the AI Did Well

The security remediation is exactly where a governed agent earns its keep. It is enormous, tedious, pattern-heavy work across dozens of files, and it is the kind of thing that quietly does not get done on a solo project because there is never a good week for it. Running it as a planned, tracked epic with the autonomous worker loop is how it actually got finished instead of staying a someday item. I also built most of the voice feature with the agent, using the newer model, in a single long evening.

What Needed Correction

Voice did not work on the first test. I wired it all up, went to bed, and the next morning the microphone path was dead. Audio pipelines have a lot of quiet failure modes, sample rates, buffering, runtime provisioning, and "it compiles" tells you nothing about whether sound actually turns into text. Now it works, but what it outputs isn't the best currently - because of the model itself.

The more interesting fix was to autonomous git flow. I realized an autonomous run should start by cutting its own branch off the current one, do all its worktree merges there, and only merge back to main if the user has auto-commit on. Otherwise it should leave the branch for the human to squash or keep as they like. An autonomous agent should never assume it gets to decide how your history looks.

What Shipped

DevNitro ran a planned security audit across the framework and remediated dozens of findings: SSRF, XSS, path traversal, IDOR, CSRF, a strict CSP, PII log scrubbing, webhook replay protection, secret scanning, and an SBOM, capped by a risk register and remediation roadmap, including replacing a runtime code-compilation engine with a no-execution allow-list evaluator. It also gained voice dictation on the CLI, web, and VS extension through a managed Whisper.net core, organizational memory resolution, hierarchical issue status rollup, and atomic issue claiming.

The Numbers

Category	Hours
Product / Features	18h 34m
Content	8h 43m
Testing	4h 20m
Deploy / Infra	2h 49m
Community	1h 52m
Docs / Skills	1h 4m
Total	37h 22m

Under eight hours of my tracked time went to security, because the agent did the bulk of the audit itself against a plan I approved. That ratio is the whole pitch: the boring, critical work gets done because the platform can carry it.

Where This Fits in Intelligent Engineering

Security is the clearest example of what Intelligent Engineering is for. It is the work everyone agrees matters and nobody has a free week to do. A coding agent that writes features faster never touches it. An agent that runs a governed audit, remediates real findings, and hands you a risk register is a different thing. It is capacity your organization did not have before. That is the line between a faster coder and an operating model: one helps a developer, the other gives the organization work it could never staff.

I'd been waiting to run this audit since I heard about Mythos. As soon as Fable 5 dropped, I pointed DevNitro at it. It found real issues, and it fixed them all inside of DevNitro itself.

Curious how this site was built?
Watch the 5-minute walkthrough on YouTube →

June 12, 2026 Build Log: An AI-Run Security Audit