Getting Ready for Jev: Installing TypeSafe’s SDK, Joining the Waitlist, and Cleaning Up My GitHub

TypeSafe AI just launched Jev, a model that makes typed decisions instead of writing text. I installed the Python SDK on Debian, wrote a phishing-classifier script, joined the waitlist, and ended up cleaning my GitHub profile and finding a .env file that shouldn't have been committed.

On September 15, 2026, TypeSafe AI came out of stealth with Jev, its first “System One” model. Jev doesn’t write paragraphs the way a chatbot does. It makes typed decisions: yes/no answers with probabilities, a choice from options you define, or a score on a scale you set. Every answer comes with a confidence level, so your software can decide when to act on its own and when to ask a human.

For someone learning cybersecurity, that’s interesting. Deciding whether an email is phishing, how urgent an alert is, or whether a log entry looks suspicious is exactly the kind of judgment Jev is built for.

So I spent a late night in Honolulu getting ready.

Step 1: Installing the SDK on Debian

Jev runs on TypeSafe’s servers, so there’s nothing to install locally except their Python SDK. It requires Python 3.10 or newer, and my Debian box is running 3.14.6.

I set up an isolated project folder so it wouldn’t interfere with my Black Hat Python or AWS study environments:

mkdir ~/jev-lab && cd ~/jev-lab
python3 -m venv venv
source venv/bin/activate
pip install --upgrade pip
pip install typesafe-sdk

Everything installed cleanly, including prebuilt wheels for Python 3.14. A quick import test confirmed it:

python -c "from typesafe_sdk import TypeSafeClient; print('SDK OK')"

SDK OK. Version 0.6.0 is ready.

Step 2: A phishing classifier, waiting for a key

I wrote a first test script, phish_check.py, that sends a fake “your AWS account is suspended” email to Jev and asks three questions:

  • Choice: is this phishing, spam, or legitimate?
  • Score: how much pressure does it put on the reader, from 0 to 2?
  • Yes/no: does it contain a link imitating a real brand?

The script reads the API key from an environment variable instead of hardcoding it. I load the key with read -s so it never appears on screen or in my bash history.

Step 3: Joining the waitlist

Jev is in early access, so I joined the waitlist and filled out TypeSafe’s extended form, which asks what you’re building and how you’d use it. The form is hosted on Typeform, and I checked that the URL traced back to typesafe.ai before entering anything. Verifying where a form really comes from is basic security practice.

I also joined the TypeSafe Discord. One note for anyone else joining: real staff have a pink “TypeSafer” role. Be careful with anyone who DMs you offering early access or asking for your API key.

Step 4: A GitHub cleanup I didn’t plan on

The waitlist form asked for my GitHub profile, which made me look at it the way a stranger would. Some changes were needed:

  • Removed two accidental pinned repos, one of which had a URL pasted in as its name.
  • Created a profile README by pushing a README.md to a repo named after my username. It now introduces me at the top of my profile.
  • Pinned my strongest public work: black-hat-python and jarvis-ai-assistant.

Step 5: The security lesson of the night

One project I wanted to pin, a personal-finance app I built with Lovable, React, TypeScript, and Supabase, turned out to be private. While checking why, I found a .env file committed to the repo.

.env files often hold keys and secrets. In my case it held only browser-safe Supabase settings, and the repo is private, but it shouldn’t have been tracked. I fixed it:

echo ".env" >> .gitignore
git rm --cached .env
git add .gitignore
git commit -m "Ignore .env"
git push

git rm --cached removes the file from GitHub while keeping my local copy. I then checked that the live app still loaded its data from Supabase, and it did.

Takeaways:

  1. A deleted file isn’t gone from git history. If a secret was ever committed, rotate it.
  2. Private repos with personal data should stay private, even when you’d like to show the work off.
  3. Keep repos in separate folders. I had accidentally cloned one repo inside another and moved it out before it caused problems.

What’s next

When my Jev invite arrives, I’ll run phish_check.py and post the results here: what Jev gets right, where it’s confidently wrong, and whether it’s useful for screening Wazuh alerts in my home lab. TypeSafe says Jev “can’t hallucinate” because it only chooses from allowed answers, but that only guarantees the format. A valid answer can still be the wrong call, and I plan to test that.

Stay tuned. Aloha from Honolulu. 🌺