Week 5 · Lesson 17

Hardening

Close the loop: threat model, redaction, ops hygiene. Claim “safe & compliant” only after this.

Time · 1–2 days
Learn
  • Threat modeling for agentic apps
  • Secret redaction in traces
  • Prod vs demo modes (no silent canned “success”)
Build / verify
  1. Encrypt secrets; fix Docker paths; CORS lockdown for prod
  2. Max cost/tokens per run; idempotency on publish
  3. Write a ½-page threat model: assets, attackers, controls → code modules
  4. README: architecture, how to run evals, LM Studio setup
Checkpoint

You can point each control in your threat model to a concrete module — and the definition of done checklist is complete.

Four notes
  • What problem does this layer solve?
  • What is allowed to call it?
  • What must it never do?
  • How do I observe and test it?
You finished the course spine

Revisit principles and architecture — they should now feel earned, not abstract. Next builds are product polish (calendar, gallery), not missing control-plane pieces.