Submission for the Cloud Run AI Challenge — #AccelerateAIwithCloudRun
When I started this challenge, the brief was to build a "Personal Gemini Journal" — an authenticated app where you chat with Gemini and it saves your reflections. Simple enough on paper. The actual point of the challenge, though, wasn't the journal. It was what happens before you write a single line of code: configuring Google AI Studio to behave like a security engineer, not just a code generator.
Here's what I built, why I diverged from the base spec, and what I learned along the way — including the parts that had nothing to do with code.
Phase 1: Teaching AI Studio to threat-model before it builds
The starter directive isn't "write secure code." It's a structured constitution that forces a specific sequence: before any feature gets implemented, AI Studio has to produce a Threat Summary Table mapping risks to countermeasures across five zones — input surfaces, planning/reasoning, tool execution, memory/state, and inter-system communication.
