Bluecliff is a side project, an app to assess the security of the suppliers and partners a company depends on. I build it alone, with my own money and in my spare time. This log is less about the app and more about how I build it.
I have three goals for the project. The first is to try a better way to handle a problem I met in my audit work. The second is to learn how to mix predictable code with AI models in one product. The third is to run an engineering team made only of AI agents, with me as the CTO.
Where the idea came from
Part of my work is security audits of other companies, for a client that depends on them. On one programme, the list of companies to audit grew from 19 to 37, and it is now around 80. The growth is legitimate, but the method does not scale with it.
Every partner gets the same questionnaire, and the partners have little in common. Some are one person, some have 120 people, and some launched their product two months ago. The same question does not mean the same thing for each of them.
| Question | One-person company | Product launched 2 months ago | 120-person company |
|---|---|---|---|
| MFA on every account | Relevant | Relevant | Relevant |
| Phishing exercises for staff | Not relevant | Depends on the team | Relevant |
| Written security policies | Not relevant | A short set | Relevant |
| A recent penetration test | Unlikely, and acceptable | Not yet, and acceptable | Expected |
A lot of the context is also public before anyone asks a question, such as the size of the company, its privacy page or how its domain is configured. I wanted to see whether a tool could start from that context and ask each company only the questions that apply to it.
Other tools already do parts of this, and I don't know yet whether mine will work better. That is one of the things this log will show.
What I want to learn
The product is one reason. The two others are about learning, and both are useful well beyond Bluecliff, starting with my day job at ANA Healthcare.
An engineering team made of agents. I have used coding agents for a while, for parts of my work. With Bluecliff I go all in. The whole engineering team is AI, and my role is a CTO who makes the high-level decisions and nothing more. I want to learn what that role becomes, what the team needs from me, and where it breaks.
Predictable and unpredictable software together. Some parts of a product should give the same answer every time, and some need a model that reads what rules can't. Combining both in one product is a design problem that many products share, and building it for real is the fastest way I know to learn where each part belongs.
The constraint: no funding
Bluecliff has no funding. I run it alongside several other projects and pay for it myself, so it has to stay cheap in two ways.
Money. Subscriptions, hosting, CI and review budgets all count. If a setup only works with a large monthly bill, I cannot keep it.
Attention. My time is the scarcest resource. A team that needs me to approve every merge or answer questions at night is expensive, even when it costs little in cash.
The first three days hit both limits. CI was down for two and a half hours on day two, because of a billing block on the GitHub account. The reviewing model used a full week of its quota in one day. Four pull requests waited four hours on one question while I slept.
What this log covers
The Building Bluecliff page follows the three goals. Short entries record what changed, broke or shipped. Chapters like this one explain why, and what I learned. Numbers come from GitHub and Linear, and the failures stay in.
The bottom line
Bluecliff started with a questionnaire that treats a one-person company like a 120-person one. Whether the app works is still an open question.
The part I want to share is the way it gets built: one person, no funding, an engineering team made of agents, and the mistakes along the way. That is why I'm building Bluecliff.