HackyJS: running an AI-assisted security blog in the open
What HackyJS covers, how its self-hosted platform and content pipeline work, and why every post discloses how much of it was AI-generated.
HackyJS is my blog about modern web development and hacking. Its tagline — from a senior to future senior hackers — describes the audience: developers who want to understand how software breaks, not just how to build it.
It is also an experiment in running a technical blog with heavy AI assistance, without pretending otherwise. This post explains what HackyJS covers and how it is put together.
What it covers#
HackyJS sits where application security and everyday web development overlap. Recent posts include:
- reproducing a public proof of concept for an unpatched remote code execution issue in LLM caching infrastructure
- testing a "2× faster" claim for a Rust-based TypeScript compiler across cold builds, incremental rebuilds, watch mode and the language server
- an audit checklist for Node.js teams weighing managed cloud AI services against vendor lock-in
- running a small open-weight coding model locally for CI repair and pull-request review
The common thread is verification. Instead of repeating announcements, a post tries to reproduce the claim, measure it, or turn it into something a team can act on. Posts are tagged by topic, and there is a separate video section.
The platform#
The site is a self-hosted Next.js application with MDX posts. It stores posts, comments and contact messages in SQLite, supports anonymous comments with token-based deletion, generates its sitemap and RSS feed, and runs in Docker. Post content and images are served from S3-compatible object storage, so the application itself stays small.
The content pipeline#
New articles come out of a local-first pipeline I built for HackyJS, which I call the orchestrator. It takes a topic, a title, or source material such as a public report, and runs a sequence of stages:
- topic expansion, title generation and selection, slug and metadata
- outline and article generation
- validation against the active topic pack, a rewrite pass, SEO tuning and a second validation
- header image prompt and image generation
- writing the MDX post, moving it to a final review state, and optionally committing it
Every stage is recorded in SQLite and can be retried on its own, so a failed image or a weak outline doesn't mean starting over. When a post is based on existing material, the pipeline is instructed to produce an original article rather than a rewrite of the source.
A small web dashboard sits on top: job status, post previews, retry and resume, bulk and series generation, and prompt topic management. The same tool can turn a post into an editable social-media carousel, or a short vertical video with a locally generated voice-over.
Being honest about AI#
Every HackyJS post opens with an AI meter that shows how much of it was AI-generated. Readers should know what they are reading, and the meter makes that explicit instead of leaving them to guess.
The pipeline is built around the same idea: generated posts end in a review state rather than going live automatically, and validation runs twice — before and after the rewrite — against the rules of the active topic pack.
What's next#
HackyJS will keep focusing on reproducible security research and honest measurements of developer tooling. If there is a claim, tool or vulnerability you'd like to see examined, get in touch.