Building Vantage AI. We scan LLMs for hallucinations and false claims about your brand β before they cost you a deal. β vantagehub.info
Joined April 2026
- Tweets 1,145
- Following 1,039
- Followers 765
- Likes 524
16 Photos and videos
Pinned Tweet
2
21
1,094
Added "alpha vs SPY" to Polaris tonight: for every closed trade, what would the same capital have made just sitting in SPY for the same dates? Rules: exact decimal math, excluded trades drop from BOTH sides, and the panel says exactly what it doesn't model. No flattering numbers.
6
New favorite abstraction in Polaris: the "episode" β flat β long β flat, derived automatically from fills. A 3-tranche entry 2-tranche exit is ONE trade, not 6 tax lots. Thesis at entry, journal while it's on, retro at close. The unit of analysis is the campaign, not the fill.
5
Big night on Polaris (my self-hosted trading research platform). Closed out the news-citation sprint and shipped 6 more tickets: trade "episodes," thesis capture, journaling, retros, and a performance dashboard. 1,127 unit 157 DB tests green. Every push security-reviewed.
8
Polaris - 3 cost leaks in my LLM spend caps:
Refused/failed calls still bill tokens; audited as $0.
Truncated output auto-retry with a LONGER prompt = guaranteed double spend.
The retry skipped the cap check.
Fix: sum cost on EVERY row. Auditing a cost isn't counting it.
6
Polaris - Audited my AI app. Every guarantee the UI made about model output was a prompt suggestion, not enforced code. The model behaved. Tests passed. And nothing actually stopped a confident BUY built on zero evidence.New rule: every promise gets a line of code that enforces it.
5
Polaris - Today's bug: "chart won't load."
The Redis URL path is a database NUMBER. Mine said /db-myapp-prod, so ioredis ran SELECT NaN. Every cache op failed silently for weeks, every render hit the API live, and the rate limit ate my chart.
The bug is never where the symptom is.
10
Polaris - Authentik 2026.5 footgun that ate my night:
`redirect_uris` looks like one allowlist. it's actually two β partitioned by a `redirect_uri_type` enum.
register a post-logout URL with the UI default type=authorization β RP-Initiated Logout silently 400s.
9
Polaris got prod HTTPS today:
- Caddy in docker w/ Cloudflare DNS-01 plugin
- Let's Encrypt for polaris.templarsec.us auth.templarsec.us
- LAN-only, no public ingress
- real certs, passkeys via Bitwarden
migrating off IONOS to Cloudflare was the long pole.
9
Founders: when's the last time you asked ChatGPT "who founded [your company]"?
If the answer is "never" β go do it now.
If the answer is wrong β that's what every buyer sees too.
Fix the input, not just the outputπ
1
17
shipped passkey auth on Polaris.
self-hosted Authentik WebAuthn via Bitwarden. no passwords anywhere. tap to sign in, JIT-provisioned user row, encrypted session cookie on real HTTPS.
passwords for personal apps in 2026 are absurd.
9
VantageAI - Quick AI-reputation tip:
Publish JSON-LD Organization Person schema on your /about page. Then push the same data to Crunchbase.
Both get heavily weighted in LLM grounding.
Want to know if the models actually picked it up?π
1
11
Polaris - News panel sentiment donut live on every instrument page π°
β’ Polygon adapter, 15-min cache
β’ SHA-256 dedup (wires get resyndicated)
β’ 60-word finance sentiment lexicon
β’ bespoke SVG donut β overall mood at a glance
Zero new deps. Zero LLM calls. (yet)
11
Polaris - Pre-push security review caught a HIGH on it:
Schema-validation retry path billed real money but logged $0. Cap never saw the spend β silent drain.
Every future AI feature would've inherited the bug.
Fix: audit every upstream roundtrip.
Reviews. Keep. Paying.
8
AI foundation on Polaris π°οΈ
Built the LLM safety layer BEFORE the first user-visible AI feature:
β’ server-side spend caps ($1/day, $20/month)
β’ prompt-injection isolation
β’ PII redaction by default
β’ audit table with NO prompt-text column
Boring. Load-bearing.
8
BidVault - Multi-tenant SaaS means one leak = everyone's data. Today: API harness ran 11/11 cross-tenant isolation checksβevery attempt to read another tenant returns a clean 404, no existence leak. Rate limits plan caps verified too. Sleep easier. #buildinpublic
1
18