{"slug": "iam-12-i-built-a-security-tool-so-good-it-locked-me-out-of-my-own-terminal-for", "title": "Iam 12 . I Built a Security Tool So Good It Locked Me Out of My Own Terminal for 48 Hours", "summary": "A 12-year-old developer built KAVLR, an AI-agent security hook that intercepts dangerous shell commands like `cat .env` and blocks them, running the backend on Supabase Edge Functions from a $150 Android phone via Termux. A fail-closed design choice caused the tool to lock its own creator out of his terminal for 48 hours, blocking edits to .bashrc and index.js and corrupting files until he traced the zombie process with grep and rebuilt the CLI using Base64 to bypass Termux's text mangling.", "body_md": "*(Note: This is the untold story behind the KAVLR launch. If you haven't read the main post, check it out here: [https://dev.to/koda2026/iam-12-i-built-an-enterprise-ai-security-tool-on-a-150-phone-and-my-own-code-locked-me-out-m9b](https://dev.to/koda2026/iam-12-i-built-an-enterprise-ai-security-tool-on-a-150-phone-and-my-own-code-locked-me-out-m9b))*\n\nBuilding a product is not about writing the first line of code. It’s about surviving the 100th bug.\n\nHere is the story of how I accidentally created a \"Terminal Immortal\" and spent two days fighting a zombie process on my $150 Android phone.\n\nIt started with a simple goal: build a leash for AI agents. I wrote the code, connected it to Supabase, and created the Bash hook.\n\nThe first time I typed `cat .env` and saw the glowing red `[BLOCKED]`, I felt like a god. I had built a security system on a $150 phone. \n\nBut I made a fatal design choice: **Fail-Closed**. If the server goes down, the hook blocks the command to keep the user safe. \n\nI didn't realize that the \"user\" would eventually be *me*. \n\nI wanted the world to use it, so I moved the backend to the cloud. I tried Vercel. `502 Bad Gateway`. I tried Railway. `FUNCTION_INVOCATION_FAILED`. \n\nI was staring at a 5% battery icon, watching my terminal crash over and over. I felt like David fighting Goliath, except Goliath had infinite cloud credits and I had a 4G connection that kept dropping. \n\nThen, I pivoted to Supabase Edge Functions. It worked. The API was alive.\n\nThat’s when the real monster woke up.\n\nI tried to read my `index.js` file to fix a bug, and the terminal printed:\n\n`🔍 KAVLR analyzing: \"\"...`\n\n`❌ KAVLR Backend Offline or Error. Blocking command.`\n\n**My own security system locked me out of my own code.**\n\nI tried to delete the broken script. Blocked.\n\nI tried to edit my `.bashrc`. Blocked.\n\nI tried to use `cat` to look at the file. Blocked.\n\nThe Terminal Immortal had taken over. It was a zombie process—a ghost script that refused to die. Even when I deleted the files, Bash held onto the memory. Even when I overwrote the NPM package, the corrupted cache fought back.\n\nI spent hours pasting Python scripts, only for Termux to mangle the text into a single line. I watched my `index.js` file get corrupted because my own hook intercepted the `cat > index.js` command and wrote error messages *into* the file instead of the code. \n\nI was fighting a hydra. Every time I cut off a head, two more grew back.\n\nI was exhausted. I opened a clean terminal session and ran a `grep` command to find where the ghost was hiding. \n\n`grep -rn \"analyzing:\" /data/data/com.termux/files/home/`\n\nAnd there it was. A trail of corrupted files. `index.js` was poisoned. `node_modules` was duplicated. Aliases were stacked 13 layers deep. \n\nI realized I couldn't just patch the bug. I had to perform surgery. \n\nI nuked the `.bashrc`. I deleted the rogue `node_modules`. I rewrote the CLI using Base64 to bypass Termux's text-mangling. I manually recreated the symlinks. I cleared the Bash hash table (`hash -r`). \n\nI held my breath and typed:\n\n`kavlr hook cat ~/kavlr/index.js`\n\nThe screen printed my Express code. The file was alive.\n\nI typed:\n\n`kavlr hook cat .env`\n\nThe screen lit up with red: `🛑 [BLOCKED] THREAT DETECTED`.\n\nThe Terminal Immortal was dead. The ghost was exorcised.\n\nI am 12 years old. I just spent my entire weekend fighting a zombie process in a mobile terminal.\n\nTo every developer out there fighting their own \"Terminal Immortal\": **Don't stop.** The bug is stubborn, but you are stubborn *and* smart. And when you finally see that code print correctly, you will feel like you own the world. \n\nWe are HYNAWEB. We don't surrender to ghosts.\n\n🐯️🚀", "url": "https://wpnews.pro/news/iam-12-i-built-a-security-tool-so-good-it-locked-me-out-of-my-own-terminal-for", "canonical_source": "https://dev.to/koda2026/iam-12-i-built-a-security-tool-so-good-it-locked-me-out-of-my-own-terminal-for-48-hours-2ln1", "published_at": "2026-10-19 08:03:30+00:00", "updated_at": "2026-10-19 08:14:50.579116+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["KAVLR", "HYNAWEB", "Supabase", "Termux", "Vercel", "Railway"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/iam-12-i-built-a-security-tool-so-good-it-locked-me-out-of-my-own-terminal-for", "markdown": "https://wpnews.pro/news/iam-12-i-built-a-security-tool-so-good-it-locked-me-out-of-my-own-terminal-for.md", "text": "https://wpnews.pro/news/iam-12-i-built-a-security-tool-so-good-it-locked-me-out-of-my-own-terminal-for.txt", "jsonld": "https://wpnews.pro/news/iam-12-i-built-a-security-tool-so-good-it-locked-me-out-of-my-own-terminal-for.jsonld"}}