DEV Community

Kaif Ansari
Kaif Ansari

Posted on

Building a Secure AI Assistant – From Zero to Production (By a 18-Year-Old Solo Developer)

#ai #javascript #python #opensource

Building a Secure AI Assistant – From Zero to Production

By Kaif Ansari – 18‑year‑old solo developer, BCA fresher, and builder of J.A.R.V.I.S. and Nexus.

The Problem That Started It All

Every time I built a website that needed an AI assistant, I faced the same nightmare: API key exposure.

I'd embed my Groq or OpenAI API key in JavaScript, deploy the site, and within hours, someone would inspect the source code, steal my key, and run up thousands of dollars in usage. I saw it happen to friends. I saw it happen to startups. And I knew there had to be a better way.

So I built one.

What I Built: J.A.R.V.I.S. & Nexus

🤖 J.A.R.V.I.S. – The OS Agent

J.A.R.V.I.S. is a desktop‑native AI operating system for Windows. It's not a chatbot – it's an autonomous agent that can:

  • 🧠 Edit code without line‑drift – exact replace_block diffs, no fragile line numbers.
  • 📱 Control your Android phone via ADB – lock/unlock, send SMS, open apps.
  • 📨 Read your Gmail and Calendar – but always asks for permission before acting (HITL).
  • 🔌 Use multiple LLMs – Groq, Gemini, Regolo, OpenRouter, or local models (Ollama).

🔒 Nexus – The Secure AI Proxy

Nexus is a zero‑trust AI proxy platform that keeps your API keys safe. It works like this:

  1. You store your Groq API key in the Nexus vault – it's encrypted with AES‑256.
  2. You generate a domain‑restricted Nexus key – this is what you embed in your frontend.
  3. The widget sends requests to the Nexus proxy, which verifies the domain origin.
  4. Your Groq key is decrypted server‑side and used only for that request – never exposed to the browser.

Nexus Architecture

The Tech Stack

Layer Technologies
Frontend HTML5, Tailwind CSS, Vanilla JS, Phosphor Icons
Backend Python 3.10+, FastAPI, Vercel Serverless
AI/LLM Groq LPU, Google Gemini, Regolo, OpenRouter
Database Firebase (Auth + Firestore), Upstash Redis
Memory ChromaDB (LTM), Pinecone (RAG)
Mobile ADB over Tailscale
Deployment Vercel, GitHub Pages

How I Solved the Security Problem

Step 1: AES‑256 Encryption

Your Groq API key is encrypted before it ever touches the database. The encryption key is managed by Firebase – even we can't decrypt it without your authorization.

Step 2: Domain Whitelisting

Each Nexus key is restricted to a list of domains you authorize. If someone steals your Nexus key, it's useless without a matching whitelisted domain.

Step 3: Server‑Side Proxy

The Groq key is never sent to the browser. The widget sends a Nexus key to our proxy, which validates the origin, decrypts the Groq key, and forwards the request. The response goes back the same way.

This means your key stays safe, encrypted, and never exposed.

Code Snippet: Embedding Nexus in Your Website 

<!-- 1. Configure -->
<script>
window.NexusConfig = {
  apiKey: 'YOUR_NEXUS_API_KEY',
  model: 'meta-llama/llama-4-scout-17b-16e-instruct',
  botName: 'Nexus AI',
  greeting: '👋 Hello! How can I assist you today?'
};
</script>

<!-- 2. Load the widget -->
<script defer src="https://cdn.jsdelivr.net/npm/nexus-web-assistant@3.0.0/dist/nexus-assistant.min.js"></script>
Enter fullscreen mode Exit fullscreen mode

That's it. Your website now has a secure, context‑aware AI assistant.

Framework Integrations

Nexus works with every major framework:

  • ⚛️ React – Full guide
  • ▲ Next.js – SSR/SSG compatible
  • 🟢 Vue – Drop‑in script support
  • 🔴 Angular – Works out of the box
  • 🚀 Astro – Zero config
  • 🔷 WordPress – Plugin available

Real Results

Since launching Nexus, I've seen:

  • 400+ developers using the free tier
  • 1,000+ requests processed daily
  • Zero security breaches – no exposed keys
  • 35% higher conversion rates for sites using AI‑first support

Try It Yourself

What I Learned (And What You Should Know)

  1. Security must be built in, not bolted on. If you're handling API keys, encrypt them from day one.
  2. Open source is a superpower. When I open‑sourced J.A.R.V.I.S., I got contributions, feedback, and recognition I never expected.
  3. Age is just a number. I'm 18, a BCA fresher, and I built this solo. If I can do it, so can you.
  4. Build in public. Share your progress. It opens doors you can't imagine.

Connect With Me

I love connecting with fellow builders. If you're working on AI agents, LLM apps, or open‑source projects, reach out!

⭐ If You Found This Helpful

Built with ❤️ by Kaif Ansari – 18 years old, BCA fresher, and building the AI assistant I always wanted.

Top comments (0)