The first TypeScript REST API framework built for secure AI-assisted
Oslo, Norway
Joined May 2026
- Tweets160
- Following301
- Followers22
- Likes60
Pinned Tweet
Just as you wouldn't drink from a contaminated stream, you shouldn't build on a contaminated supply chain. DaloyJS is the "filtration system" for modern JS development.
The DaloyJS score increased from 76/100 to 99/100 after using the prompt to improve the button on is-agentic.com by @vercel.
Thanks to @shadcn UI. Our website doesn't look like frontend AI slop. It's worth using ui shadcn create with a little effort rather than letting the AI do all your frontend UI from scratch. daloyjs.dev 😉
Tanya Janca's @shehackspurple DevSecStation @devsecstation episode on secure defaults matches why we built DaloyJS the way we did. "The easiest path is often the insecure one."
Security on by default, insecure paths explicit and effortful. Login with JWT is not enough, and telling an AI to build an API does not make the easy path safe.
daloyjs.dev/blog/secure-defa…
The global average hit $4.99 million USD, AI-driven attacks are up 56%, and 92% of AI-related breaches lacked basic access controls. Here is a quick summary of the IBM Cost of a Data Breach 2026 report. daloyjs.dev/blog/ibm-cost-of…
The DaloyJS 1.0.0 stable version is here 🎉🎉🍻🍻.
Secure-by-default HTTP routes matter more now because APIs get scaffolded and shipped faster than people configure them. If the framework doesn't block the dumb stuff first, production often ships without it.
daloyjs.dev/blog/daloyjs-1-0…
Newly released. We have a @scalar section on our landing page, and it is pretty. ☺️ daloyjs.dev/
We have documentation of how to use @tursodatabase in a daloyjs service. daloyjs.dev/docs/databases/t…
We are a documentation of how to use @postmarkapp with DaloyJS 😊. daloyjs.dev/docs/email/postm…
DaloyJS 1.0.0-rc.0: the first release candidate.
The public API is frozen now. Only bug fixes and docs until 1.0.0 GA.
The beta run quietly added a dependency-free MCP server and a faster Node hot path.
Build something real on it and find the bug I missed 👇
daloyjs.dev/blog/daloyjs-1-0…
OTel-shaped spans without a hard dependency on @opentelemetry api. Bring your own tracer; DaloyJS just emits the right shape — on every runtime.
daloyjs.dev/docs/tracing
AI now writes ~24% of production code, and 1 in 5 teams report a serious AI-code incident.
Our take on what @AikidoSecurity + Sapio Research's State of AI in Security & Development 2026 means for backend teams: stricter contracts, CI gates, less tool noise.
daloyjs.dev/blog/state-of-ai…
The launch post. One `app.route({...})` becomes your validation, types, OpenAPI, typed client, and contract tests. The same app runs on Node, Bun, Deno, Workers, and Vercel Edge. One route, many runtimes, zero ceremony.
daloyjs.dev/blog/introducing…
Pretty API docs are great until they drift from the contract. DaloyJS ships `docs.scalar` — theme it, hide Try-it, drop in a brand stylesheet — and locks the spec URL to your live OpenAPI path at serialize time. No drift.
daloyjs.dev/blog/branded-api…
Codegen agents kept hallucinating my call sites. So DaloyJS added a `meta` field on every route — structured examples, x-* extensions, validated against your schema, dumped to routes.json for Claude/GPT/Hey API to read.
daloyjs.dev/blog/ai-friendly…
A tour of the always-on defenses in the DaloyJS request path — the ones you no longer have to remember to turn on — plus the opt-in upgrades worth flipping today. Security shouldn't be a checklist you forget at 2am.
daloyjs.dev/blog/secure-by-d…
One `app.route({...})` projects into `generateOpenAPI(app)`, `createClient(app)`, and `runContractTests(app)`. Plus `pnpm gen` for a Hey API typed fetch SDK your frontend imports directly. One definition, no babysitting.
daloyjs.dev/blog/contract-fi…
We are writing a post about the @AikidoSecurity latest State of AI security development in 2026. We are really thankful to see the reports they gathered. aikido.dev/state-of-ai-secur…
