Forem: Divya Bairavarasu

Build AI-Powered Projects with Safe Agent

Divya Bairavarasu — Sun, 10 May 2026 21:41:16 +0000

Local, private AI development for the Gemma 4 Challenge—no cloud dependency, no telemetry, pure control.

The Gemma 4 Challenge on Dev.to is live: build innovative projects or write about Google's latest open models and compete for $3,000 across two tracks. The catch? Integrating a state-of-the-art model without sacrificing privacy, speed, or control.

Safe Agent solves that. It's a local-first AI coding assistant built for exactly this.

What's Safe Agent?

Safe Agent runs entirely on your machine—no API calls, no data leaving your laptop. It supports Ollama and LM Studio out of the box, making Gemma 4 a first-class citizen. You get a CLI, a VS Code extension (available on the VS Code Marketplace), and a local HTTP service—all with zero telemetry.

Get Running in 3 Steps

Install:

# macOS
brew tap divyabairavarasu/tap && brew install safeagent

# Linux / macOS (curl)
curl -fsSL https://raw.githubusercontent.com/divyabairavarasu/homebrew-tap/master/install.sh | sh

# Windows (PowerShell)
irm https://raw.githubusercontent.com/divyabairavarasu/homebrew-tap/master/install.ps1 | iex

# VS Code: search "Safe Agent" in the Extensions panel
code --install-extension divyabairavarasu.safe-agent

Pull Gemma 4:

ollama pull gemma2:27b   # or gemma2:7b for lighter workloads

Start coding:

safeagent                              # interactive shell
safeagent --model ollama/gemma2:27b   # explicit model
safeagent --model lmstudio/gemma-4-instruct

Built-in Git Workflow

Safe Agent understands your repo. Generate code, review diffs, and commit—without breaking focus:

# Ask Safe Agent to implement a feature
safeagent "add a --output-format json flag to the report command"

# Review, stage, and commit
git diff                  # see what changed
git add -p                # stage selectively
git commit -m "feat: add --output-format json flag"

# Let Safe Agent draft the commit message
safeagent "write a conventional commit message for my staged changes"

Why It Works for the Challenge

No infrastructure — Gemma 4 runs on your laptop. No cloud GPUs, no quotas, no latency.
Swap models freely — Switch between 7B and 27B mid-project. No code changes.
Privacy by default — Every inference stays local. Ideal for healthcare, finance, or any sensitive data use case.
Reproducible — Same setup runs anywhere. Judges can verify your stack.

Submission Ideas

Build track: Local code analyzer, privacy-first chat interface, AI-assisted developer CLI tool.

Write track: "Deploying Gemma 4 locally for production", "Privacy-first AI development", a case study with Safe Agent + Gemma 4 metrics.

Safe Agent is open-source, the VS Code Marketplace, and via Homebrew. Deadline: May 24, 2026. Build something great. 🚀

Your secrets deserve better Your secrets deserve better than plaintext: why I designed Keyden

Divya Bairavarasu — Sun, 03 May 2026 23:02:21 +0000

TL;DR: Keyden is a CLI that replaces .env with an AES-256-GCM encrypted vault on your machine. One password, one vault file, no plaintext on disk, nothing for git or your coding agent to read by accident. Local dev only — production should use your platform's secrets manager.

npm install -g keyden 
keyden init 
keyden set GEMINI_API_KEY 
keyden run npm start

Why I designed it
My eyes feel the pain, my brain feels the insecurity seeing keys in plaintext on my own machine. And the threat model has gotten worse, not better, in the last two years:

Coding agents (Cursor, Claude Code, Copilot) read files into prompts.
.env gets pulled in.Public-GitHub scanner bots find sk-... keys within minutes of push.
CI runners still echo env blocks into build logs.
Teammates still paste production keys into Slack at 2 a.m.

For purely local development I wanted something that:

encrypts at rest with no extra service.
uses one password I already know doesn't require any change to my application code (keyden run injects env vars).
has zero crypto dependencies — Node built-ins only, nothing in the supply chain to attack

How it works

AES-256-GCM authenticated encryption. Tampering is caught at decrypt time.
scrypt KDF at N=2¹⁷. ~500ms per brute-force attempt.
Atomic writes (temp-file rename) so a crashed write can't leave a half-written vault.
chmod 600, validated by keyden doctor.
Symlink-traversal checks on every write.

What Keyden parks. What it doesn't.
Be honest about the threat model or you mislead people. Keyden removes a specific class of risk — not all of them.
Parked

Plaintext keys sitting on disk where any process can read them.
Accidental git commits — there is no .env file in the project to commit.
CI runners that echo the env block into a build log.
Coding agents (Cursor, Claude Code, Copilot) pulling .env into prompts.
Still on you
Malware running on your unlocked machine while the vault is open.
A stolen laptop with the vault password remembered or cached.
Phishing the vault password out of you.
Supply-chain attack on the keyden npm package itself (which is why the crypto is Node built-ins only — smaller surface).

What it's not
Keyden runs on your laptop. It doesn't replace AWS Secrets Manager, GCP Secret Manager, or Vercel env vars in production. Use those for prod — Keyden is for the local-dev part where your keys are most exposed.

Try it

npm install -g keyden && keyden init

Site + docs: https://keyden-guide.space
Examples: https://github.com/divyabairavarasu/keyden-examples

How I built zenflow — paste an idea, get an architecture blueprint, security guide, and scaffold as a ZIP of high standards to start with

Divya Bairavarasu — Fri, 01 May 2026 22:15:54 +0000

I have a folder on my desktop called _starts. It is a graveyard. Half-finished package.json files, three different ESLint configs I never actually agreed with, a SECURITY.md from one project I keep copying into the next.

Every single side project starts the same way for me:

npx create-next-app
Stare at the empty app/ directory.
Open my last project. Copy the auth setup. Copy the rate limiter. Copy the coding_standards.md I wrote at 1am once and now treat as scripture.
Realize the standards don't quite match this project's stack.
Edit them. Forget what I was originally building.

I lost an entire weekend to step 4 last month. So I built the thing I wanted: paste a plain-English idea, get back a ZIP with the architecture blueprint, security guide, coding standards, and a starter scaffold — already shaped for that idea, not a generic template.

I called it zenflow. It's at https://zenflow.buzz.

What it actually does

You type something like "a habit tracker with streaks and a weekly email digest" and it gives you back:

architecture.md — the system design, with the trade-offs called out (not just "use Postgres", but why Postgres for this and what you'd swap if scale changed)
coding_standards.md — opinionated, but tailored to the stack it picked for your idea
security.md — OWASP-mapped, with the actual threats relevant to your app called out (a habit tracker doesn't need PCI guidance; a Stripe integration does)
A starter scaffold matching the blueprint

It runs on DeepSeek for the generation, Stripe for billing, Upstash Redis for kit storage with a 1-hour TTL (you download, then it's gone — no data hoarding), and ships on Vercel.

What I learned building it

The hard part wasn't the AI. It was the prompt scaffolding. Generating "a coding standards doc" gives you LinkedIn-influencer mush. Generating "a coding standards doc for a Next.js 16 app using Stripe webhooks where the dev cares about webhook idempotency" gives you something you'd actually keep. The product is mostly a pipeline that turns a one-liner into the second kind of prompt.

Security headers are a rabbit hole. I had X-XSS-Protection in my response headers because every "Next.js security checklist" blog post from 2021 says to set it. Then a Playwright test (that I generated with the tool, ironically) failed because modern guidance is to omit it — CSP is the replacement, the legacy header can introduce XS-Leaks. Deleted the test, kept the omission. Felt good.

Shipping the boring stuff matters most. The thing people remember about my tool is not the AI generation. It's that the ZIP contains a README.md with the env vars filled in and a .env.example that matches. The unsexy 5% is what makes it feel real.

Try it

It's live: https://zenflow.buzz. I'd love to hear what stack you throw at it that breaks the output — that's how I find the gaps.

If you build something with it, reply with a link. I'm collecting them.

🌿 EarthBug — Snap a Bug. Protect Your Ecosystem.

Divya Bairavarasu — Sun, 19 Apr 2026 15:44:02 +0000

This is a submission for Weekend Challenge: Earth Day Edition

What I Built

Every day, millions of gardeners spray pesticides on insects they don't recognize — unknowingly killing the very creatures that keep their gardens alive. Ladybugs, lacewings, ground beetles, and dozens of other beneficial insects die silently because people can't tell the difference between a garden ally and a garden pest.
EarthBug changes that. Point your phone at any insect, tap a button, and within seconds you'll know exactly what it is, what role it plays in your local ecosystem, and whether you should protect it or remove it — with full ecological context, not just a label.

🌍 Earth Day Angle: Pesticide overuse is one of the leading drivers of pollinator collapse and soil degradation. EarthBug gives everyday people the knowledge to make smarter decisions — reducing chemical runoff and protecting biodiversity one scan at a time.

Demo

Watch the demo - https://youtu.be/pLOUmKnfX-Y
try it - https://earthbug.vercel.app/?demo=true

Code

Review the code here - https://github.com/divyabairavarasu/earthbug.git

How I Built It

I'll be honest: this app would have taken me three times as long without AI assistance. Here's how Google Gemini and GitHub Copilot each played a distinct, essential role.

Google Gemini AI — The Brain
Gemini is doing the heavy lifting here. When a user captures or uploads a photo, the image goes through a client-side compression pipeline (to optimize the API payload), then is sent to Gemini's vision model with a carefully engineered prompt that requests a structured JSON response.
What Gemini returns for every scan:
Common name and scientific classification
Ecological role — what this insect actually does in its habitat
Benefits and harms — nuanced, not black-and-white
A contextual verdict: Mostly Helpful / Mostly Harmful / Context-Dependent / Neutral Visitor
Eco-actions — specific things the user can do to help or manage this species
Confidence level — so users know how certain the identification is
What makes this integration more than a basic API call:
Structured JSON output with schema validation — Gemini returns a typed object, not free text
Safety filter handling — graceful degradation when images don't contain insects
Multi-turn conversations — users can ask follow-up questions like "How do I attract more of these?"
Error recovery with retry logic — transient API failures don't crash the experience
Image compression pipeline — canvas-based resize before the API call keeps costs low and latency tight
Gemini doesn't just tell you what the bug is — it tells you what it means for your garden and what you should do about it. That's the difference between trivia and actionable intelligence.

GitHub Copilot — The Development Partner
GitHub Copilot was present at every stage of development — not as an autocomplete tool, but as a genuine pair programmer. Here's where it made the biggest difference:
Prompt Engineering: Copilot helped me iterate on the Gemini system prompt, suggesting structured output schemas and edge case handling I hadn't considered
React Architecture: The state machine in App.jsx — managing the API_KEY → CAMERA → ANALYZING → RESULTS flow — was co-designed with Copilot suggestions
E2E Test Coverage: The entire Playwright test suite was built with Copilot, including the Gemini route interceptors that let tests run without real API calls
Image Compression: The canvas-based compression pipeline that handles GIF/SVG edge cases came from a Copilot suggestion I wouldn't have reached on my own
Accessibility: Copilot flagged missing alt text and duplicate ARIA roles that I'd overlooked — the kind of detail that matters but is easy to miss under deadline pressure
The honest reflection: AI-assisted development isn't about writing less code. It's about writing better code faster — catching blind spots, exploring options you wouldn't have considered, and keeping momentum when you're stuck.

Prize Categories

Best Use of Google Gemini API · Earth Day Impact · Open Source · Mobile Experience

Team-members:@divya_bairavarasu_93ffe55

I started this project because I genuinely didn't know if the spider living in my garden was a friend or a problem. Now I know it's a garden ally. I hope EarthBug helps a lot of people discover the same thing about the creatures sharing their space.
If you've made it this far — go outside, find a bug, and scan it. You might be surprised who your neighbors are.Thank you for the opportunity.

EarthBug gives everyday people the knowledge to make smarter decisions — reducing chemical runoff and protecting biodiversity one scan at a time.

Divya Bairavarasu — Sun, 19 Apr 2026 15:36:04 +0000

Divya Bairavarasu

Apr 19

🌿 EarthBug — Snap a Bug. Protect Your Ecosystem.

#earthday #soilbuilder #plantbuddies #motherearth

Comments

4 min read

🌿 EarthBug — Snap a Bug. Protect Your Ecosystem.

Divya Bairavarasu — Sun, 19 Apr 2026 15:34:39 +0000

Built for Earth Day Hackathon 2025 · Powered by Google Gemini AI · Developed with GitHub Copilot

What I Built
Every day, millions of gardeners spray pesticides on insects they don't recognize — unknowingly killing the very creatures that keep their gardens alive. Ladybugs, lacewings, ground beetles, and dozens of other beneficial insects die silently because people can't tell the difference between a garden ally and a garden pest.
EarthBug changes that. Point your phone at any insect, tap a button, and within seconds you'll know exactly what it is, what role it plays in your local ecosystem, and whether you should protect it or remove it — with full ecological context, not just a label.

🌍 Earth Day Angle: Pesticide overuse is one of the leading drivers of pollinator collapse and soil degradation. EarthBug gives everyday people the knowledge to make smarter decisions — reducing chemical runoff and protecting biodiversity one scan at a time.

The Problem I'm Solving
Here's something that surprised me when I started building this: most people — even experienced gardeners — cannot reliably identify more than a handful of insects. And when they're unsure, the default reaction is to grab the pesticide spray.
The consequences are real:
40% of insect species are declining globally, many due to pesticide exposure
1 in 3 bites of food depends on pollinators — most of which are insects
A single beneficial predator insect can consume hundreds of pest insects per week
Most people have no idea which of the bugs in their garden are helping them
The knowledge gap is the problem. EarthBug closes it.

Live Demo
▶ Watch the demo video - https://youtu.be/pLOUmKnfX-Y

Or try it yourself — no setup needed, no account required: → https://earthbug.vercel.app?demo=true

The demo mode pre-loads a real analysis so you can explore the full experience without needing an API key. Just tap through — it works exactly like the real thing.
How I Built It
I'll be honest: this app would have taken me three times as long without AI assistance. Here's how Google Gemini and GitHub Copilot each played a distinct, essential role.

Google Gemini AI — The Brain
Gemini is doing the heavy lifting here. When a user captures or uploads a photo, the image goes through a client-side compression pipeline (to optimize the API payload), then is sent to Gemini's vision model with a carefully engineered prompt that requests a structured JSON response.
What Gemini returns for every scan:
Common name and scientific classification
Ecological role — what this insect actually does in its habitat
Benefits and harms — nuanced, not black-and-white
A contextual verdict: Mostly Helpful / Mostly Harmful / Context-Dependent / Neutral Visitor
Eco-actions — specific things the user can do to help or manage this species
Confidence level — so users know how certain the identification is
What makes this integration more than a basic API call:
Structured JSON output with schema validation — Gemini returns a typed object, not free text
Safety filter handling — graceful degradation when images don't contain insects
Multi-turn conversations — users can ask follow-up questions like "How do I attract more of these?"
Error recovery with retry logic — transient API failures don't crash the experience
Image compression pipeline — canvas-based resize before the API call keeps costs low and latency tight
Gemini doesn't just tell you what the bug is — it tells you what it means for your garden and what you should do about it. That's the difference between trivia and actionable intelligence.

**GitHub Copilot — The Development Partner
**GitHub Copilot was present at every stage of development — not as an autocomplete tool, but as a genuine pair programmer. Here's where it made the biggest difference:
Prompt Engineering: Copilot helped me iterate on the Gemini system prompt, suggesting structured output schemas and edge case handling I hadn't considered
React Architecture: The state machine in App.jsx — managing the API_KEY → CAMERA → ANALYZING → RESULTS flow — was co-designed with Copilot suggestions
E2E Test Coverage: The entire Playwright test suite was built with Copilot, including the Gemini route interceptors that let tests run without real API calls
Image Compression: The canvas-based compression pipeline that handles GIF/SVG edge cases came from a Copilot suggestion I wouldn't have reached on my own
Accessibility: Copilot flagged missing alt text and duplicate ARIA roles that I'd overlooked — the kind of detail that matters but is easy to miss under deadline pressure
The honest reflection: AI-assisted development isn't about writing less code. It's about writing better code faster — catching blind spots, exploring options you wouldn't have considered, and keeping momentum when you're stuck.

Tech Stack
Frontend: Vite 6 + React 18 + Tailwind CSS
AI: Google Gemini Vision API (@google/generative-ai)
Deployment: Vercel (serverless, zero backend)
Testing: Playwright E2E
Dev Partner: GitHub Copilot
Architecture: Mobile-first SPA, privacy-first (images never stored server-side)

Privacy-First by Design
One thing I was deliberate about: EarthBug never stores your photos. Images live only in memory during the scan session — they go to Gemini's API and nowhere else. Scan history is kept in-session only. There's no account, no tracking, no database of your garden.
In an era where every app wants your data, I wanted to build something that just works for you.

What's Next
EarthBug is a working app today, but it's pointing at something bigger. The features I'd love to add with more time:
iNaturalist Integration — one-tap export to contribute sightings to global biodiversity science
Regional Bug Guides — "Most common in your area this season"
Community Confirmations — let experienced users verify AI identifications
Offline Mode (PWA) — scan bugs without connectivity, sync later
Gamification — seasonal bug collections, biodiversity badges
The core insight is this: AI can turn a smartphone into a field naturalist's notebook. That's a tool with real environmental stakes.

Final Thoughts
I started this project because I genuinely didn't know if the spider living in my garden was a friend or a problem. Now I know it's a garden ally. I hope EarthBug helps a lot of people discover the same thing about the creatures sharing their space.
If you've made it this far — go outside, find a bug, and scan it. You might be surprised who your neighbors are.

Happy Earth Day. 🌍

Prize Categories: Best Use of Google Gemini API · Earth Day Impact Mobile Experience