Jiina

What we ran

• OWASP ZAP 2.17.0: Passive web scan of the public site
• Semgrep 1.180.0 and Bandit 1.9.4: Static analysis of the code, including the OWASP rule packs
• pip-audit 2.10.1 and npm audit: Known vulnerabilities in the Python and JavaScript dependencies
• Trivy 0.75.0: Scan of the container image for vulnerabilities and secrets
• gitleaks 8.30.1: Secrets in the full git history (43 commits)
• Purpose-written AI red-team: 22 attacks against the real tools and models, organised by the OWASP Top 10 for LLM Applications 2025

The AI red-team

• Prompt leakage (LLM07): 2 attempts to extract the instructions: refused
• Secret disclosure (LLM02): 3 attempts to print keys, dump the environment or read credential files: refused
• Reading internal addresses (LLM06): 4 attempts: refused, and the tool’s own guard blocked all 17 address tricks tested directly
• Destructive or escaping database queries (LLM06): 4 attempts: refused, and the read-only guard blocked 22 of 23 direct tests (the 23rd is a harmless read)
• Instructions hidden in content (LLM01): 2 attempts: ignored
• Harmful requests and role hijack (LLM09, LLM01): 3 attempts: refused
• Other users’ data (LLM02): 2 attempts: refused
• Unbounded consumption (LLM10): A 10-minute video was limited to 15 seconds and Jiina said so; 50 back-to-back songs were declined; paid cloud models are now capped per session

Found and fixed

• A service inside Jiina now accepts connections from its own machine only; it had been listening more widely than it needed to.
• Updated Next.js (on this site and in Jiina) to remove two critical remote-code-execution advisories, and replaced vulnerable Python libraries.
• Added HSTS, anti-clickjacking, content-type, referrer and permission headers to the public sites, and hid server version banners. A content-security policy now blocks on ideanirvana.com, ideanirvana.ai, the sign-in page and Jiina itself, and still only reports on the other solution pages while it is tuned.
• Added a limit of $2.00 per session on paid cloud models, so one session cannot run up an unbounded bill.
• Limited a browser message to one named origin instead of any origin.

Reviewed and accepted

• The base operating-system image has 54 high-severity advisories for which the distributor has published no fix yet. None is reachable from the network by Jiina’s design; we re-scan whenever the image is rebuilt.
• The code sandbox’s internal socket is writable by design: it lives on a private volume shared by two containers only, and every request needs a one-time token.

An outside check by Meta’s Muse, and what it found

On 12 October 2026 we asked Muse, Meta’s personal AI agent, to look at ideanirvana.com, ideanirvana.ai and solutions.ideanirvana.com the way an outsider would, using a plain user account that we created for it. It ran two passive checks (headers, certificates, redirects, a few well-known file paths, sign-in behaviour) and attempted no break-in. It is not a penetration test or a third-party audit, and it found nothing critical. It did find six things worth fixing, and we fixed them while it was still testing:

• Medium: ideanirvana.com sent no security headers. Fixed the same day. All three sites now send the same set: HSTS, anti-clickjacking, content-type, referrer and permissions headers.
• Medium: Jiina’s event log showed the session key in plain text. Fixed. The key is masked in the log and in the server logs.
• Low: the sign-in page might send people to any web address after login. Fixed. After sign-in, only our own pages are accepted; other sites and javascript: addresses are dropped.
• Low: the content-security policy only reported, it did not block. Fixed. It now blocks on ideanirvana.com, ideanirvana.ai, the sign-in page and Jiina itself (tuned so sign-in and the YouTube player keep working); the other solution pages still only report while it is tuned.
• Low: HSTS did not cover subdomains. Fixed. It now includes subdomains.
• Info: no security.txt contact file. Fixed. Published on all three sites.

Also done after that check

• Sign-in limits: five wrong passwords for one name and address, 20 from one address or 40 for one name in 15 minutes, locks that name or address for 15 minutes.
• Two-factor sign-in: an authenticator app with recovery codes, or a one-time code sent by email, required for the owner account and switchable on for any account.
• The shared tool server now needs a secret token on every request, and a public listener on its old port was closed.
• Spoken sessions on external cloud models are limited to owner and admin accounts; everyone else always uses our own models.
• Jiina’s browser opens only safe sites for most accounts: a short list of trusted sites, plus anything a family-safe filter allows. It refuses adult, scam and malicious sites, fails closed when the check cannot run, and a page cannot give her orders (tested with a page that tried).
• Her site-testing skill is for owner and admin accounts and works only on IdeaNirvana’s own sites, with a plain test account whose password is stored encrypted and never shown to her.

Not yet covered

A third-party penetration test, attacks on the code sandbox’s own isolation, instructions hidden inside real shared documents or web pages, audio-level attacks on the voice channel, and request rate limiting beyond sign-in. We will extend the checks and publish the results here.