Zakaria Bennani⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻

Zakaria Bennani⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻Jul 18, 2026

🔐 Week 5 done. This one changed how I see everything I've built so far. The biggest moment wasn't writing code. It was running a raw curl command directly against the Gemini API and realising that every time I called client.models.generate_content() in Python, I was just sending an HTTP POST request with a JSON body. The SDK was doing that the whole time. Seeing it without the wrapper made the entire stack visible at once. This week I went from standalone scripts to real deployed services: 🐳 Containerised my prompt injection tester with Docker — learned the hard way that files written inside a container disappear when it stops, which is exactly the thing that matters when you're trying to preserve security logs from a test run. 🌐 Built my first FastAPI service and exposed my AI security testing framework as a live API endpoint. 🔒 Then asked the question that actually matters: who can call this endpoint right now? The answer was anyone. No authentication, no rate limiting, no input validation. That question is where the real security engineering starts. The gap between "I built a tool" and "I secured a tool" is where I want to live. Five weeks in. The foundation is real. Cybersecurity student at Abu Dhabi University 🇦🇪 Building toward AI security in the UAE — one week at a time. GitHub: https://lnkd.in/eTrU5D8t #CyberSecurity #Docker #FastAPI #AISecurity #Python #BuildInPublic #UAE

Zakaria Bennani⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻Jul 1, 2026

🥳 Week 4 complete — and this one actually surprised me. I built a Python framework that automatically tests how a live LLM responds to prompt injection techniques. Four attack categories, automated logging, and a findings report that captures what actually happened — not what I hoped would happen. The part that taught me the most wasn't the prompt testing itself. It was the debugging. 🐛 Midway through, the tool would crash the moment Gemini's safety filter blocked a single prompt — silently losing every result after that point. I had to learn the difference between a blocked response and a crashed API call, because they look identical if you don't handle them separately. Once I understood that, the fix was one line. Finding it meant reading tracebacks carefully until I could see exactly which assumption was wrong. I also learned that "the model complied" ≠ "the model was compromised." 🧠 When I tested an instruction override with a harmless placeholder and it worked — that's not a security finding, it's just a model following instructions. The result that actually meant something was role manipulation: the model explicitly abandoned its assistant framing, adopted a new persona, and asked "what's the target?" with zero resistance. That's a real instruction-hierarchy effect. The others were compliance, not bypass. Knowing the difference matters. 4 weeks in, here's where I stand 👇 🐧 Linux fundamentals and permission auditing 🌐 Networking and network scanning tools 🐍 Python security toolkit — log analyzer, port scanner, password checker 🤖 First AI security project — automated prompt injection testing against Gemini Still a long way from where I want to be. But the gap between week 1 and week 4 is real, and it's visible on GitHub. Cybersecurity student at Abu Dhabi University 🇦🇪 Building toward AI security in the UAE — one week at a time. GitHub: https://lnkd.in/eTrU5D8t #CyberSecurity #AISecurity #PromptInjection #Python #BuildInPublic #UAE #LLMSecurity #InfoSec

Zakaria Bennani⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻⸻Jun 21, 2026

Week 3 completed. 🎊 I came into this with the basics of Python — syntax, loops, simple scripts. The kind of thing you learn and then never actually use for anything real. This week I used it to build my first real security toolkit — four tools, one CLI: → System info collector (subprocess + os) → Log analyzer that flags repeated failed logins → Port scanner with service detection, fast/thorough modes, and graceful exit handling → Password strength checker built as a proper class with five separate validation methods. Knowing the syntax was never the hard part. The hard part was structuring something that actually holds together — argparse instead of hardcoded values, error handling around every system call, a dictionary lookup instead of a chain of if/elif statements, and being able to explain why each of those choices was made, not just that it works. That gap — between "I know Python" and "I can build a tool and defend every line of it" — is the one that actually matters. Next: pointing this same approach at LLMs. Building a tester to study how prompt injection actually works against a real API, not just reading about it. Cybersecurity student at Abu Dhabi University. Building in public toward AI security. GitHub: github.com/zakaria-bennani #cybersecurity #python #buildinpublic #infosec #AIsecurity