S3 · AI Security Testing

Test the AI boundary with written authorization and findings that have owners.

You get the authorization written down, a named boundary, checks that leave evidence and findings with owners. At the higher levels the checks become repeatable: from L3 APPLY you can run your own inert checks from one command and from CI, and at L4 SCALE they become an owned operating model.

Best for: Security-minded QA engineers, developers and security leads who test LLM-enabled systems they are authorized to test.

Get it free See the five levels and prices

The free L0 workflow is the Initial LLM Boundary Review Workflow. Every level is available in our store. L0 and L1 are also on Gumroad. Paid purchases: 7-day money-back guarantee and at least six updates a year for five years, as set out in the terms.

S3 · AI Security Testing: five workflow levels from L0 FREE to L4 SCALE, with a sample HTML report

Sound familiar?

Nobody has written down what you may test, or who owns a finding.
A one-time scan leaves you with comfort you cannot defend.
Security wants repeatable checks with evidence, and right now the answer lives in one expert's memory.

These are typical situations; none of them is a customer quote.

See the series in under two minutes

English narration with captions.

Five levels. Stop where the job is done.

Each series has five levels. Every level includes all earlier levels of the same series, so the level you choose is the point where you want to stop. L4 SCALE is the complete series. It contains L0, L1, L2 and L3 of the same series, each in its own folder.

S3 · AI Security Testing · L0 FREE

Initial LLM Boundary Review Workflow

Free includes L0

Find the first security questions worth testing around an LLM, with written authorization and a named owner.

Best for: Engineers and QA practitioners starting an AI security review who want the scope and authority written down first.

You walk away with

A boundary map that names what is in scope and who is responsible for it.
A list of authorized checks built from inert, sanitized test cases.
A finding-or-gap record for anything you observed, and the owner of the next action.
An HTML report from one command on the bundled synthetic example, with English and Polish guidebooks and a 14-page guide.
A blank input template with a field guide for your own scope. Left unfilled, it stops with a clear TEMPLATE_NOT_FILLED message and writes no report.
29 automated tests, including positive, negative and recovery cases.

L1 START, Authorized Prompt Injection Review, reviews the prompt-injection evidence you collect, with authorization and evidence limits written into the report.

Get it free · our store Also on Gumroad Workflow details

Choose the checkout you prefer; receipts and updates come from where you buy.

S3 · AI Security Testing · L1 START

Authorized Prompt Injection Review

$19 one-time · includes L0-L1

Review prompt-injection evidence you collected, with authorization and evidence limits written into the report.

Best for: Security-minded QA engineers who test an LLM application and need a finding they can defend, with the limits of the evidence stated.

You walk away with

A test scope, a source-linked injection evidence pack, a finding draft and an owner action, plus an HTML report.
24 inert prompt-injection cases in 6 categories, each with a unique canary token, a recording sheet and a converter that turns the filled sheet into the review input. The library sends nothing: you send the inputs to a system you are authorized to test and paste the answers.
An authorization gate that comes before any check, and a blank input template with a field guide for your own scope.
Five single-purpose skills: authorization gate, fixture preparer, injection checker, evidence collector and finding reporter. Each carries an expert playbook with a procedure, a checklist, common mistakes and a worked example on the bundled data.
An operating guide (4 pages in English and in Polish), a workflow guidebook (20 pages in English and in Polish), a 39-page English field guide, and 47 automated tests with positive, negative and recovery cases.

L2 UNDERSTAND, LLM Security Review, starts from a threat model and turns it into authorized checks and findings with owners.

Get L1 START for $19 · our store Also on Gumroad Workflow details

Choose the checkout you prefer; receipts and updates come from where you buy.

S3 · AI Security Testing · L2 UNDERSTAND

LLM Security Review

$49 one-time · includes L0-L2

Move from a threat model to authorized security checks and findings that each have an owner.

Best for: Security engineers, QA practitioners and technical leads who review LLM risk and need each finding to have an owner and a retest.

You walk away with

A threat and control map, a case plan, an assessment register, finding drafts and an owner retest and remediation plan.
Templates for a decision record, RACI (responsible, accountable, consulted, informed), risk register, review checklist and a review-input file.
CI examples for GitHub Actions (including a scheduled run), GitLab CI, pre-commit and make.
A worked example with English and Polish reports, a 107-page field guide and 55 automated tests.

L3 APPLY, AI Security Test Implementation Workflow, runs your own authorized, inert checks against one endpoint you name, keeps hashed evidence and connects the results to your delivery process.

Get L2 UNDERSTAND for $49 · our store Workflow details

S3 · AI Security Testing · L3 APPLY

AI Security Test Implementation Workflow

$99 one-time · includes L0-L3

Run your own authorized, inert AI security checks against one endpoint you name, keep hashed evidence, and fail the build when results are missing or stale.

Best for: Engineers who want authorized AI security checks to run from one command and from CI, with the contract, the authorization and the evidence rules settled first.

You walk away with

An authorized local check runner. It sends the inert, canary-based checks your contract defines to one endpoint you name, only inside a valid authorization window and boundary, and records hashed evidence in the results schema. It sends nothing when authorization is missing, expired or out of scope. It runs only the checks you wrote: it does not scan, attack or certify.
A bundled stub target with a hardened and a vulnerable mode, so you see a clean run and a failing run locally first, and a make and GitHub Actions chain that fails on missing or stale results.
A security check contract, an evidence schema, an integration plan, a run record and a gate decision as reviewable documents, with templates for an authorization record, check catalog, cleanup runbook, findings register and results policy.
A worked invoice-agent example in English and Polish, CI and pre-commit examples, a 113-page field guide and 80 automated tests. A clean run covers only the trials you ran against the build you name.

L4 SCALE, Enterprise AI Security Framework, makes AI security testing an owned operating model with a control library, monitoring and staged adoption.

Get L3 APPLY for $99 · our store Workflow details

S3 · AI Security Testing · L4 SCALE

Enterprise AI Security Framework

$149 one-time · includes L0-L4

L4 SCALE is $50 more than L3 and adds a security framework blueprint, a control library, an ownership matrix and an adoption plan; every level below it is included.

What you paid for any lower level of the same series counts toward any higher level (L1 START at $19 makes L4 SCALE cost $130). To claim it, email hello@nobrainer.tech with your receipt (how the credit works).

Make AI security testing an owned, reviewable operating model across teams: risk map, control library, ownership and staged adoption.

Best for: Security and engineering leaders who govern AI systems across teams and want each person's responsibility to be visible to the whole team.

You walk away with

A security framework blueprint, a control library, an ownership matrix and an adoption plan, plus one HTML report.
Templates for a governance charter, quarterly review checklist, exception register, evidence-freshness tracker and testing-authorization record.
An ed-tech example run before and after a change, in English and Polish.
CI and pre-commit examples, an 89-page field guide and 68 automated tests.
The complete series: every earlier workflow of AI Security Testing is inside this level.

You have the complete AI Security Testing series. The natural next series is AI Engineering & Orchestration, which limits what your AI agents may touch in the first place.

Get the complete series (L4 SCALE) for $149 · our store Workflow details

Prices are cumulative: each price covers that level and every level below it. Adding up the prices of several levels counts the lower levels more than once, so the catalog shows no sums or savings. What you paid for any lower level of the same series counts toward any higher level (L1 START at $19 makes L4 SCALE cost $130). The upgrade question below shows how to claim it.

What you get from the series

How it works

Authorize the scope, map the boundary, design inert test cases, review the evidence you record, and hand each finding to an owner. Authorization and evidence rules sit in front of every step. At L3 APPLY the kit also runs the inert checks you wrote against one endpoint you name, keeps hashed evidence, and fails the gate when results are missing or stale.

What we can show

Five workflows with 279 automated tests, all passing in our run of the 2026-10-01 release build.
Worked examples: a finance assistant (L2), an invoice agent and a runner example with a bundled hardened and a bundled vulnerable stub target (L3), and an ed-tech platform before and after a change (L4).
English and Polish guidebooks in every package; the field guides at L2, L3 and L4 run 107, 113 and 89 pages. L4 adds its own guide on top of the L2 and L3 guides that are inside the download.

No customer results are claimed. Every report states what was and was not checked.

Common objection

“Will it attack my system for me?”

No. Up to L2 the included code reviews the records you supply, offline, and sends nothing. From L3 APPLY the kit can send the inert, canary-based checks you wrote to one endpoint you name, and only inside a valid written authorization window and boundary. By default that endpoint is a stub that ships in the package. It does not scan, attack or certify anything, and it is not a penetration test report, a legal opinion or a compliance certificate.

Questions before you buy

What does each level include?

Every level includes all earlier levels of the same series: L1 START is L0-L1, L2 UNDERSTAND is L0-L2, L3 APPLY is L0-L3, and L4 SCALE is L0-L4, the complete series. Each level sits in its own folder in the download.

Why would I choose L4?

L4 SCALE is the whole series in one purchase: all five workflows, from the free starting point to the blueprint for running the practice across teams. It suits leads who already know they will use more than one level, or who need the top-level ownership, gates and rollout planning. If you are unsure, start with the free L0 workflow or L1 START. What you paid for any lower level of the same series counts toward any higher level (L1 START at $19 makes L4 SCALE cost $130). Each price covers that level and everything below it.

If I start at L1, what does an upgrade cost?

It costs the listed price of the higher level minus what you already paid for a lower level of the same series. What you paid for any lower level of the same series counts toward any higher level (L1 START at $19 makes L4 SCALE cost $130). You never pay twice for the levels below. It works for purchases made in our store or on Gumroad, and only for a higher level of the same series. To claim it, email hello@nobrainer.tech with your receipt, the level you want and the address you will use at checkout. We check the purchase and reply with a one-time link that applies the credit at checkout. The credit is personal, like the license: it is tied to that email address, and it does not apply to a purchase that was refunded.

What do I need to run a workflow?

A terminal and Node.js 22 (LTS). Two L1 START workflows, the Initial LLM Test Checklist (S2 · AI Evaluation & Reliability) and the Authorized Prompt Injection Review (S3 · AI Security Testing), start with Python 3.10 or newer instead. You unzip the package, run one command on the bundled example and open the HTML report; the command itself finishes in seconds. No particular AI assistant is needed to run the included code. In S5 · AI for Work & Business you write no code, and you still need a terminal and Node.js 22, installed once.

What guarantee and updates come with a paid purchase?

Paid workflow purchases carry a 7-day money-back guarantee: ask for a full refund within 7 calendar days, no questions asked, and keep the files you downloaded for personal use. They also include at least six updates in each 12-month period for five years from the purchase date, at no extra charge for those updates, made available through the platform where you bought. The update commitment covers the workflow you bought. It does not cover separate products, additional levels, custom implementation or third-party subscriptions. Your personal license does not expire when the five years end. Results vary and are not guaranteed, and mandatory consumer rights stay in place.

What is the difference between our store and Gumroad?

Our store carries all 25 workflows, L0 to L4 in five series. Gumroad carries only the ten L0 and L1 workflows and points here for L2 to L4. The L0 and L1 workflows are the same in both places. Files, receipts and updates come through the platform where you bought, and Gumroad acts as merchant of record for purchases made there, so its checkout terms apply as well.

Is it safe to use with my own data?

Use sanitized records: no credentials, cookies, personal data, production secrets or unrestricted logs. The included code runs locally and calls no model or provider. Network requests exist in one place only: the authorized check runner of S3 · AI Security Testing (L3 APPLY, also inside L4 SCALE) sends your inert checks to the one endpoint you name, by default a local stub, and refuses to send anything outside a valid authorization window and boundary. Instruction-like text inside your input is treated as data, and some workflows stop when they meet it. Security workflows also require written authorization for anything you test.

Can my team share one purchase?

A purchase is a personal, non-transferable license for one person, and sharing the files needs written permission. When several people need a workflow, each person can have their own copy: email hello@nobrainer.tech with the series, the level and how many people, and we will reply with the options. If you would rather have a workflow built around your own process, see Custom Workflow On Demand for the details.

More questions on the workflow catalog page

Not sure where to start?

Open the free L0 workflow, run the example, read the report and move up only when the next level fits your work.

Get it free Compare all five series

Built on NoBrainer.Tech Flow, the free open project that gives your coding assistant one routine from task to done. You do not need Flow to run the included code. NoBrainer.Tech Flow on GitHub.