Closed until launchPlatform with an autonomous guardCase study
Alwaei Alfikri
A school platform I still operate, defended by an agent that runs whether or not I am awake.
01The situation
A live platform for a school community, running on free-tier infrastructure with no operations team, no on-call rotation and no budget. The constraint is not elegance — it is that nobody is watching at 3am.
So the defense cannot be a person reading a dashboard. It has to be code that acts.
02Decisions
Three Durable Objects, each with one job: a rate limiter, a live competition room, and WebRTC signalling using the hibernation API so idle rooms cost nothing.
A guard on three clocks. A 60-second alarm, a 10-minute cron, and synchronous hooks that screen each message at the moment it is sent — so the fast path is not waiting on the slow one.
Graded response, not binary. Normal, elevated and lockdown levels, with automatic banning once an accumulated threat score crosses a line, plus honeypot routes that no legitimate client ever requests.
A prompt-injection guard that logs every attempt, scores it, and suspends the source for an hour after three — because the platform exposes an AI assistant, and the assistant is an attack surface like any other.
Mesh WebRTC for twelve without a TURN server, with a shared whiteboard, live polls and AI-generated minutes — all of it inside the free tier.
03The failure that taught the most
Key-value storage on this platform has a daily write quota, and quotas do not degrade — they cliff. When it ran out, registration and login stopped working, silently, in the middle of a day.
The repair was two-part and both parts matter. A fallback layer in a Durable Object so data survives the cliff and returns when the quota resets at midnight; and a unique error code surfaced to the user for every failure path, so the next silent failure is one search away from its cause.
The lesson generalised beyond this platform: a counter written as read-then-write on eventually-consistent storage loses updates under concurrency — measured here at 7 lost writes out of 13. Send the cumulative value, never the increment.
04Limits
Free infrastructure is a real constraint, not a badge. Mesh WebRTC does not scale past roughly a dozen participants, and without a TURN server some restrictive networks simply will not connect.
The guard is tuned against the traffic it has seen. A patient attacker who stays below the threshold is, by construction, invisible to it.
05Screens7
Captured on 10 October 2026 from the platform’s own build; the live site is closed to visitors until its official launch.
06What you can check yourself
Each row is a source you can open or a method you can repeat.
- LinkClosed to visitors until its official launch by the school.
- CertificatesAppreciation — intellectual security programmeAl-Rayyan Intermediate School · 2026
- Screens7 screensCaptured on 10 October 2026 from the platform’s own build; the live site is closed to visitors until its official launch.
Talk about this project
For judges, mentors and security teams — WhatsApp and email reach me directly, and I reply myself. Open to mentorship and cybersecurity programmes.