📝 README and project documentation churn 12 commits 2mo ago minor change
Dshamir/AI-Legal
Hardened, self-hosted Mike fork with Prisma ORM, Redis caching, and a Docker-based AI Legal stack.
Dshamir/AI-Legal has been through substantial infrastructure work since forking. The main themes: backend request hardening (input validation, structured logging, error tracking via Sentry, Content Security Policy), a credit enforcement layer, and workflow export/import. On the data side, the Supabase SDK was replaced with Prisma ORM for database access. Frontend work added auth middleware, error tracking, and accessibility improvements.
The self-hosting story got significant attention - a custom ailegal.sh orchestration script drives a Docker stack, and the repo ships CI via GitHub Actions. Redis caching and HTTP cache headers arrived alongside encryption key rotation. The repo also carries substantial README and roadmap churn, which suggests active development with someone thinking about future architecture.
What's in it
- Self-hosted deployment Packaged as a turnkey stack a firm can stand up on its own servers instead of depending on the upstream cloud.
- Vendor independence The backend was reworked to drop its lock-in to one hosting vendor, so it can run against a standard database.
- Metered, multi-tenant service Per-user credit limits and importable/exportable workflows lay the plumbing for running AI-Legal as a paid, multi-user product.
- Security hardening Login enforcement, request validation, content-security policy, error tracking, and cherry-picked upstream security fixes across the front and back end.
- Operational resilience Caching and the ability to rotate the encryption protecting stored API keys without taking the service offline.
- Quality gate A test harness and continuous-integration pipeline so changes are checked before they land.
Direction
infrastructuresecuritymulti-tenant
Activity
📝 Dshamir puts a meter on Mike and lets you carry workflows out the door 2 commits 2mo ago workflowmulti-tenant draft
Two additions move this fork toward something you could actually hand to a team: per-user usage caps and portable workflows.
📝 Dshamir quietly patches the attacks nobody else got to 4 commits 2mo ago securityinfrastructure draft
Four commits, four different ways an attacker could have pried open a Mike deployment - each one closed.
Thirteen commits turn the upstream prototype into a self-hosted stack you can stand up on a single machine without a DevOps team.
📝 Testing harness and GitHub Actions CI 7 commits 2mo ago minor change
📝 Dshamir is publishing the blueprint before laying a brick 4 commits 2mo ago infrastructureintegration draft
A set of detailed roadmap documents lays out exactly where this fork's plumbing is headed - no code yet, but enough specificity to know what's coming.
📝 Dshamir bolts locks and alarms onto AI-Legal's front end 3 commits 2mo ago securityinfrastructure draft
A round of production hardening: server-side access control, crash monitoring, and a fix that stops the app falling over before it even loads.
📝 Dshamir makes Mike quicker on its feet and safer with its keys 3 commits 2mo ago securityinfrastructure draft
Three commits add caching for speed and a way to swap the master encryption secret without breaking anything already locked up.
📝 Dshamir rips out Mike's database plumbing and quietly adds an audit trail 6 commits 2mo ago infrastructurecompliance draft
A full rewrite of how the backend talks to its database, with two changes that matter to lawyers tucked inside.
📝 Dshamir stops treating AI-Legal's backend like a prototype 6 commits 2mo ago securityinfrastructure draft
A batch of work turns the server from "trust me" into something that checks what it's handed and keeps a clean record of what it does.
Threads of work (detailed view)
Dshamir puts a meter on Mike and lets you carry workflows out the door
Two additions move this fork toward something you could actually hand to a team: per-user usage caps and portable workflows.
Monthly credit metering and workflow export/import
Dshamir adds per-user monthly credit enforcement on both chat streaming routes and portable workflow files - two product features that signal the fork is targeting metered multi-tenant operation.
Dshamir quietly patches the attacks nobody else got to
Four commits, four different ways an attacker could have pried open a Mike deployment - each one closed.
Security fixes: filename sanitization, timing-safe HMAC, HKDF salts, RLS deny-all
Dshamir integrates four upstream PRs addressing concrete vulnerabilities: a prompt-injection vector via crafted filenames, a length-oracle side channel in download token verification, weak API key encryption, and an open PostgREST data plane with no row-level access control.
Dshamir makes Mike run on one box, one command
Thirteen commits turn the upstream prototype into a self-hosted stack you can stand up on a single machine without a DevOps team.
11-service self-hosted stack with a Bash orchestrator
Dshamir converts the upstream prototype into a turnkey self-hosted deployment: a `docker-compose.yml` spanning 11 services, a `ailegal.sh` CLI that wraps Compose with health checks, dynamic port allocation, and database commands, and a round of first-run bug fixes to make the whole thing actually work on a fresh machine.
Dshamir is publishing the blueprint before laying a brick
A set of detailed roadmap documents lays out exactly where this fork's plumbing is headed - no code yet, but enough specificity to know what's coming.
Roadmap documents: distributed workers, MCP/plugin architecture, deployment path
Dshamir commits a series of planning documents laying out where the fork is heading: a 295-line candidate PRD for BullMQ worker offloading, an MCP server/client and plugin system design, local and cloud LLM provider support, and a Docker Compose to Kubernetes progression via k3s, Helm, and KEDA.
Dshamir bolts locks and alarms onto AI-Legal's front end
A round of production hardening: server-side access control, crash monitoring, and a fix that stops the app falling over before it even loads.
Next.js auth middleware, Sentry wiring, and a build-time crash fix
Dshamir adds Next.js auth middleware, client-side error tracking, and an accessibility skip-link to the frontend, then fixes a build-time crash where the Supabase client threw on empty env vars during static page generation.
Dshamir makes Mike quicker on its feet and safer with its keys
Three commits add caching for speed and a way to swap the master encryption secret without breaking anything already locked up.
ioredis cache-aside helpers, Cache-Control middleware, and AES key rotation
Dshamir adds three independent backend-ops primitives: a Redis client with cache-aside helpers, HTTP Cache-Control middleware, and an encryption key rotation module for stored user API keys.
Dshamir rips out Mike's database plumbing and quietly adds an audit trail
A full rewrite of how the backend talks to its database, with two changes that matter to lawyers tucked inside.
Full Prisma migration: Supabase SDK data access removed from 13 files
Dshamir replaces every `supabase.from()` call in the backend with Prisma client queries against Postgres, decoupling persistence from the Supabase SDK. This is the fork's largest single change - 13 files rewritten, roughly 2100 lines net removed.
Dshamir stops treating AI-Legal's backend like a prototype
A batch of work turns the server from "trust me" into something that checks what it's handed and keeps a clean record of what it does.
Four request-hardening primitives wired into Express
Dshamir adds Zod validation, Pino structured logging, GlitchTip/Sentry error tracking, magic-byte MIME validation, and a strict Helmet CSP to the Express backend - all as self-contained modules that drop in without touching route logic.