AI Server Management, AI-Handoff creation, Deployment and backup tool - Now I’m getting cold feet before beta testing (UK) Advise greatly appreciated

[u/NewHype2022]

Hi all,

I’ve been building a complete Ubuntu server management software for some time now.
Full disclosure, I have used AI extensively to code but I have engineered and been the systems architect - this is NOT a quickly thrown together “AI slop” project.

The tool essentially auto-installs on a fresh Ubuntu server from your account on my website, it acts as a full server manager. It can give a very detailed handoff link to an AI of your choice, giving it instructions of how to safely build the project with you and giving it read only access to the initial files it needs in the new project.

It has a project deployer, to take care of everything from downloading the stack to configuring and launching.

It has a full backup client that you can install on a separate server (or as many as you choose) that keeps a fully encrypted full site backup of your build/data.

I genuinely haven’t seen another product that does the same thing and I’m really excited to get it tested. I just want to be responsible and I’m just super nervous.

I have the company registered, I’ve registered with the ICO, paid the fee.

I’m literally right next to being ready to press the button and open Beta testing for the initial few to try the product.

The issue is. I’ve suddenly become really anxious about releasing the project.
I’m contemplating bringing a CTO co-founder on board on an equity basis for that piece of mind and to assist me with what has become a great but complex piece of machinery.

Has anybody else been through this?

How did you handle risk reduction? I’ve done everything that I can think of and hardened my privacy policy, T&C’s, Beta agreement. All of the things that I can think of to release this responsibly.

I guess I just thought that I’d see if anybody else has released a technical project such as this. It’s entirely self funded, so I can’t really spend thousands at this point on pentesting.

[u/Warm_Effective8903]

Totally normal to feel this way,, start with a tiny closed beta (3-5 trusted people, non-production servers) instead of public signups, that alone kills most of the real risk. For the backup/root access parts specifically, get a cheap freelance security review instead offull pentesting or a co-founder, you've already done the hard compliance work most people skip.

[u/NewHype2022 → u/Warm_Effective8903]

Thanks for your reply.
I realise that I’ve probably been looking at worst case scenarios and edge cases and scaring myself but yes, I think your answer is probably right on the money.
I have already done extensive work to check and recheck against all openly available best practices.
It’s just nerves at this point.

So yes, I’ll do a much smaller closed beta and be very specific in the Beta agreement - specifically people on non prod servers and then I can really quickly patch and work on any issues that they find.

[u/Warm_Effective8903 → u/NewHype2022]

No problem! You've really covered your bases already, legal, compliance, best practices, all of it. The nerves you're feeling are totally normal for anyone who actually cares about doing this right. Good luck with the closed beta, I think it'll go smoothly especially since you can react fast to any issues. Excited to hear how it goes!

[u/Desk_setup_ideas]

Honestly, I think the anxiety makes sense with something this close to the infrastructure itself.
You don’t necessarily need to jump straight to a full pentest either. Before opening the beta, I’d have someone who wasn’t involved in building it try to break the obvious things: permissions, exposed credentials, deployment endpoints, backup access, and anything that accepts user input. The other thing I’d want is a really good rollback and recovery plan. If something does go wrong with the first few users, knowing exactly how to restore everything is a big part of reducing the risk. I’d probably do that before bringing in a CTO just for peace of mind.

[u/NewHype2022 → u/Desk_setup_ideas]

Really appreciate your comment.
Yeah, it’s a really project but it does sit very close to infrastructure.
I’ve measured against all best practices and regularly run tests on the entire codebase against a compiled list of multiple best practices across different agencies - a self penetration exercise, but obviously not a paid test.

I think the whole CTO idea is just jitters but also, when I’m further along, I’ll bring somebody in who has equal passion for similar things.

I have a whole load of exciting things lined up - Developer commissioning for people to accept AI projects, with a sandboxed VPS for development and demonstration to the client.

An Dev community to get support with using the tool etc - it’s free to use at its core, so I’m working on getting a community involved.

It’s just a lot to be focussing on at the start 😅

[u/NewHype2022 → u/[deleted]]

Thanks, really appreciate it.
I haven’t done an external Pentest because I simply cant afford it right now, this is self funded and it’s costing me a significant amount in the various monthly services and many servers that I have running to build, run and test it.
But - that doesn’t mean that I haven’t built this with best practices and in depth self testing in mind.
I’ve build an advanced auditing prompt that runs a scan of the entire codebase and checks it thoroughly against best practices from the provided resources.

I’m doing this every few days and updating against my progress.
Moving from Urgent -> high importance -> best practice.
I’ve got the urgent ones fixed, most of the high importance - though, using logic and not trying to pretend that every single edge case can be mitigated, rather just managing risk appropriately.

[u/bpuecickly5]

I like the AI handoff idea a lot, especially if it keeps server state, recent changes, and next steps in one predictable format. Id probably add a generated diff or changelog plus explicit rollback instructions so the next agent isnt guessing what happened. Keeping secrets and credentials out of the handoff by default would also be a big win.

[u/NewHype2022 → u/bpuecickly5]

Thanks for your reply and feedback!
I have actually already implemented all of that.
No credentials are stored when installing on the VPS, the handoff link is read-only and does not give the AI any authority to write.
There is a rollback feature for any deployment failure - no failed process will allow the deployment tool to push the web app to live, instead it will give a detailed error log for the team or AI to read.

I am working on a deeper git-style var on each version and a version rollback cache - so the user can decide how much previous data to keep (depends on their project complexity and their server size).
A small new build might prioritise building quickly and fixing any issues later, whereas a more developed project might then go into a far more safeguarded cycle.

As for secrets and credentials relating to the app/site - currently the tool shares the full project, but I’m planning to add a selectable security option for this.
A solo dev who is working on the start of a project will be far less sensitive to this, let’s say than a developed platform with users.

The feedback is super helpful and I’ve used the product extensively throughout testing, it’s been really helpful with my own projects.