# Iam 12 . I Built a Security Tool So Good It Locked Me Out of My Own Terminal for 48 Hours

> Source: <https://dev.to/koda2026/iam-12-i-built-a-security-tool-so-good-it-locked-me-out-of-my-own-terminal-for-48-hours-2ln1>
> Published: 2026-10-19 08:03:30+00:00

*(Note: This is the untold story behind the KAVLR launch. If you haven't read the main post, check it out here: [https://dev.to/koda2026/iam-12-i-built-an-enterprise-ai-security-tool-on-a-150-phone-and-my-own-code-locked-me-out-m9b](https://dev.to/koda2026/iam-12-i-built-an-enterprise-ai-security-tool-on-a-150-phone-and-my-own-code-locked-me-out-m9b))*

Building a product is not about writing the first line of code. It’s about surviving the 100th bug.

Here is the story of how I accidentally created a "Terminal Immortal" and spent two days fighting a zombie process on my $150 Android phone.

It started with a simple goal: build a leash for AI agents. I wrote the code, connected it to Supabase, and created the Bash hook.

The first time I typed `cat .env` and saw the glowing red `[BLOCKED]`, I felt like a god. I had built a security system on a $150 phone. 

But I made a fatal design choice: **Fail-Closed**. If the server goes down, the hook blocks the command to keep the user safe. 

I didn't realize that the "user" would eventually be *me*. 

I wanted the world to use it, so I moved the backend to the cloud. I tried Vercel. `502 Bad Gateway`. I tried Railway. `FUNCTION_INVOCATION_FAILED`. 

I was staring at a 5% battery icon, watching my terminal crash over and over. I felt like David fighting Goliath, except Goliath had infinite cloud credits and I had a 4G connection that kept dropping. 

Then, I pivoted to Supabase Edge Functions. It worked. The API was alive.

That’s when the real monster woke up.

I tried to read my `index.js` file to fix a bug, and the terminal printed:

`🔍 KAVLR analyzing: ""...`

`❌ KAVLR Backend Offline or Error. Blocking command.`

**My own security system locked me out of my own code.**

I tried to delete the broken script. Blocked.

I tried to edit my `.bashrc`. Blocked.

I tried to use `cat` to look at the file. Blocked.

The Terminal Immortal had taken over. It was a zombie process—a ghost script that refused to die. Even when I deleted the files, Bash held onto the memory. Even when I overwrote the NPM package, the corrupted cache fought back.

I spent hours pasting Python scripts, only for Termux to mangle the text into a single line. I watched my `index.js` file get corrupted because my own hook intercepted the `cat > index.js` command and wrote error messages *into* the file instead of the code. 

I was fighting a hydra. Every time I cut off a head, two more grew back.

I was exhausted. I opened a clean terminal session and ran a `grep` command to find where the ghost was hiding. 

`grep -rn "analyzing:" /data/data/com.termux/files/home/`

And there it was. A trail of corrupted files. `index.js` was poisoned. `node_modules` was duplicated. Aliases were stacked 13 layers deep. 

I realized I couldn't just patch the bug. I had to perform surgery. 

I nuked the `.bashrc`. I deleted the rogue `node_modules`. I rewrote the CLI using Base64 to bypass Termux's text-mangling. I manually recreated the symlinks. I cleared the Bash hash table (`hash -r`). 

I held my breath and typed:

`kavlr hook cat ~/kavlr/index.js`

The screen printed my Express code. The file was alive.

I typed:

`kavlr hook cat .env`

The screen lit up with red: `🛑 [BLOCKED] THREAT DETECTED`.

The Terminal Immortal was dead. The ghost was exorcised.

I am 12 years old. I just spent my entire weekend fighting a zombie process in a mobile terminal.

To every developer out there fighting their own "Terminal Immortal": **Don't stop.** The bug is stubborn, but you are stubborn *and* smart. And when you finally see that code print correctly, you will feel like you own the world. 

We are HYNAWEB. We don't surrender to ghosts.

🐯️🚀