DEV Community

Leo Laish
Leo Laish

Posted on

Why We Open-Sourced Our AI Safety Layer

#opensource #ai #github #security

Why We Open-Sourced Our AI Safety Layer

When we built the AI safety layer for As You Wish (AYW), we faced a choice: keep it proprietary or open-source it to help the community. Here's why we chose the latter (and why it made our platform stronger).

The Problem: AI Safety is Hard (And Everyone's Reinventing the Wheel)

If you're building AI-assisted development tools, you need:

  • Input validation (sanitizing prompts, preventing injection)
  • Output filtering (catching unsafe code, biased responses)
  • Audit logging (tracking every AI decision)
  • Human approval workflows (gating risky operations)
  • Transparency layers (explaining WHY the AI made a decision)

We spent 8 months building this. Then we realized: every AI tool builder is solving the same problems.

Our Decision: Open-Source the Safety Layer

Six months ago, we open-sourced our AI safety layer at github.com/ayw-ai/safety-layer.

What We Open-Sourced 

ayw-safety-layer/
├── input-validation/
│   ├── prompt-sanitizer.js     # Strips injection attempts
│   ├── context-validator.js    # Ensures safe context passing
│   └── schema-enforcer.js      # Validates AI inputs against schemas
├── output-filtering/
│   ├── code-scanner.js         # Flags unsafe code patterns
│   ├── bias-detector.js        # Detects biased outputs
│   └── pii-redactor.js         # Removes PII from responses
├── audit-logging/
│   ├── decision-logger.js      # Logs every AI decision
│   ├── trail-reconstructor.js # Rebuilds decision trees
│   └── compliance-exporter.js # Exports for SOC2, HIPAA
├── human-approval/
│   ├── workflow-engine.js      # Manages human-in-the-loop flows
│   ├── approval-ui.js          # React components for review
│   └── escalation-handler.js   # Routes to humans when needed
└── tests/
    ├── security.test.js        # 500+ security test cases
    ├── compliance.test.js      # Audit trail validation
    └── performance.test.js     # Benchmarks (<10ms overhead)
Enter fullscreen mode Exit fullscreen mode

License: MIT (use freely, contribute back if you can)

Why We Did It

1. Security Through Transparency

Proprietary security is oxymoronic. By open-sourcing, we got:

  • 500+ pairs of eyes reviewing our safety logic
  • 23 security vulnerabilities found by community (we'd missed)
  • Faster patching (community submitted PRs with fixes)
  • Trust from enterprise users ("We can audit your safety layer")

2. Better Code Quality

Open-source forced us to:

  • Document everything (or no one could use it)
  • Write cleaner interfaces (or contributions would be messy)
  • Add comprehensive tests (or community would find regressions)
  • Simplify architecture (or adoption would be low)

Our code quality score (SonarQube) went from 6.2 to 8.7 after preparing for open-source.

3. Community Contributions

In 6 months, we've received:

  • 47 pull requests (32 merged, 15 in review)
  • 12 new safety checks we hadn't thought of
  • 3 new output filters for medical, legal, financial domains
  • 8 performance optimizations (latency dropped 40%)

Example: A Ph.D. student added a novel bias detection algorithm. Now all AYW users benefit.

4. Talent Attraction

Open-sourcing helped us hire:

  • 2 senior engineers who'd used our safety layer elsewhere
  • 1 security researcher who contributed 5 PRs before joining
  • 3 interns from universities using our code in research

The Business Impact

Adoption Metrics (6 Months Post-Open-Source)

  • GitHub Stars: 3,200+
  • Forks: 450+
  • Production Users: 50+ companies using our safety layer
  • Community: 200+ developers in our Discord

AYW Platform Metrics

  • Enterprise Sales: 3x increase (customers trust our security)
  • Security Incidents: 0 (community finds issues before production)
  • Sales Cycle: 40% shorter ("We reviewed your open-source safety layer")
  • Customer Retention: 95% (they've integrated our open APIs)

How We Did It (Practical Guide)

Step 1: Choose What to Open-Source

DO open-source:

  • Safety/security libraries (not your secret sauce)
  • Common utilities (others need them too)
  • Standards/schemas (help the industry)

DON'T open-source:

  • Your core AI models
  • Proprietary algorithms
  • Customer data handlers

Step 2: Prep the Codebase 

# 1. Extract safety layer into separate module
mkdir ayw-safety-layer
cd ayw-safety-layer

# 2. Add proper documentation
cat README.md
# - What it does
# - How to install
# - API reference
# - Contributing guidelines
# - Security policy

# 3. Add tests (aim for 80%+ coverage)
npm test
# 87% coverage - good enough for launch

# 4. Choose license (we picked MIT)
echo "MIT" > LICENSE

# 5. Set up CI/CD
# - Automated tests on PR
# - Security scanning (Snyk, npm audit)
# - Linting + formatting
Enter fullscreen mode Exit fullscreen mode

Step 3: Launch & Community Building

Launch Announcement (Dev.to + Hacker News):

  • Title: "We open-sourced our AI safety layer (and why you should too)"
  • Key points: problem, solution, why open-source, how to contribute

Step 4: Maintain & Grow

  • Respond to issues within 48 hours
  • Review PRs weekly
  • Add contributors as maintainers
  • Celebrate contributions (shoutouts, contributor spotlights)

Challenges (It's Not All Sunshine)

1. Time Investment

  • Initial prep: 3 weeks
  • Ongoing: 4 hours/week
  • Worth it? Yes - community saves us 20+ hours/week

2. Security Scares

  • Someone found a vuln in our open code (good - we patched it fast)
  • Lesson: Have a security policy + responsible disclosure

3. License Confusion

  • Had to ensure no GPL code snuck in
  • Lesson: Scan dependencies before open-sourcing

The Future: AI Safety Standards

We're working with:

  • Stanford HAI on safety benchmarks
  • Partnership on AI on transparency standards
  • OpenAI, Anthropic on shared safety schemas

Why? AI safety shouldn't be a competitive moat. It should be table stakes.

Your Turn: Should You Open-Source?

Ask yourself:

  1. Is there a common problem your team solved?
  2. Would others benefit from your solution?
  3. Can you maintain it (time + commitment)?
  4. Does it strengthen (not weaken) your business?

If yes → open-source it. You'll be surprised how much it gives back.

Get Involved

What's your experience with open-source? Have you used (or contributed to) an open-source AI safety tool? Drop a comment - let's discuss.

This is Article 5 in AYW's Developer Relations series.

Tags: #opensource #ai #security #github #community #ayw

Series: AYW Community & Ecosystem (Part 5 of 6)

Top comments (0)