Uncensored Local AI for App Security: Three Setups, Real Risks

Mark Kashef built a test application called Coach Vault with invented clients and payment records, then asked a small local model to examine it. In his demo, the agent reached data and an admin account that a stranger should not have been able to access. The lesson is not that an “uncensored” model magically finds bugs. It is that a model with browser, research and scanning tools can run a long investigation, and that the same freedom makes its scope, permissions and source matter even more.

Watch Mark's Walkthrough

Source Note

This article uses Mark Kashef's video and the transcript supplied with it. On 27 October 2026, I checked the linked repositories and product documentation for the harness, browser and scanning tools, deployment options, and model-supply-chain warning. The Coach Vault test, quoted speed and GPU price are Mark's reported demonstration, not results independently reproduced for this article.

What the Coach Vault Demo Does and Does Not Prove

Mark says the app ran on a real server and database but contained made-up customer information. He gave an agent a starting URL, no test credentials, and tools for browser interaction, web research and vulnerability checks. The agent's final report described an unauthenticated route to customer records and admin-level access, along with a sequence of actions and suggested fixes.

That is a useful illustration of why a public deployment deserves testing before real clients use it. It is one deliberately weak app and one demonstration, not a measured success rate for all local models. The video does not establish that every scanner result is true or that any model can safely investigate arbitrary websites. If you reproduce the exercise, use your own isolated target, synthetic data and explicit authority; do not try the same prompt against someone else's live service.

A Separate Testing Boundary

For a first experiment, use a staging app you own, synthetic records and a written allowlist. Start with read-only access, approve active tests separately, and verify suspected findings independently. These are boundaries for the security-testing task, not a fourth model-hosting route. Running inference locally does not by itself restrict which files, services or network destinations an agent's tools can reach.

What “Uncensored” Means Here

In the video, “uncensored” means a model or service that is less likely to refuse a request. Some downloadable models are edited through a process often called abliteration to reduce refusals. That is different from being more capable, more accurate or more secure. Removing a refusal behavior can also change performance in ways that require fresh testing. Mark's forecast that mainstream models will keep becoming more restrictive is his prediction, not a documented universal rule.

A harness is the surrounding agent system: it chooses the model, presents tools, stores sessions and decides which actions need approval. The same model can behave very differently if one harness offers only a chat box while another offers a browser, a shell, credentials and outbound network access. DeepSeek's own safety notice warns that its developer-preview harness can execute generated commands and reach whatever files, processes, network and secrets you expose to it.

Choose the Route Before Choosing a Model

Mark starts with hosted providers because they can supply a model through an API key, then moves to a RunPod Pod and finally to LM Studio. None of these options is inherently private or inexpensive. A hosted API receives the prompts you send it. A rented server remains cloud infrastructure. A local model can still pass data to external browser, search, scraping or agent tools. Choose according to the data path and approved task, not the “uncensored” label alone.

Repos and Tools by Role

This is the working stack shown or discussed in the episode. Follow the linked maintainers' documentation for current setup and permissions; the list is not an instruction to install every tool at once.

The DeepSeek Harness Setup, Without Guessing at APIs

The official DeepSeek Harness repository calls the project dsh and labels it a rapidly changing developer preview. Its current README documents npx @deepseek-ai/dsh web as a local Web UI launch, with a source-build path for people modifying the code. Review the repository, its safety notice and the installed version before running it on a computer with sensitive files.

The model-provider guide shows Settings → Models for built-in providers and a Custom model API option for other gateways or local servers. The custom entry needs the actual base URL, protocol, credential if applicable, and exact model ID. It can query supported model lists where the endpoint provides them; otherwise add the model ID manually. Do not paste a provider key into a chat transcript, commit it to Git or hand it to the testing target. Use the harness's credential storage or another secret manager.

Mark asks Codex to read the harness and provider documentation and help wire them together. That can save configuration time, but review the proposed package, permissions, command and endpoint before authorizing execution. Confirm a harmless test message works with the selected model before attaching more powerful tools.

Add Browser and Scanner Tools in Stages

Mark's three additions have distinct jobs: Playwright MCP drives a browser, Firecrawl MCP retrieves web content, and Nuclei runs template-based checks. Start with only the first tool needed for a specific question. A browser can test normal user journeys without immediately granting a terminal and broad web research.

Firecrawl's official docs now describe keyless limited access, account sign-in and API-key access; an API key is not always required for its limited search/scrape surface. Nuclei's public templates are useful evidence, but a match is not a finished security finding and a clean scan is not a clean bill of health. Its default request rate can be high, so select appropriate templates and cap traffic for a staging host you own. Microsoft also states that Playwright MCP is not a security boundary. Restrict the agent's environment and approvals separately.

Give tools separate scopes: an allowlisted staging origin for browser work; a narrow set of documentation domains for research; and a test-only target for active scans. Treat retrieved pages as untrusted data. Keep production tokens, customer records, local .env files and personal browser profiles out of the agent workspace.

RunPod: Renting the Model Is Not “Set and Forget”

In route two, Mark rents a GPU Pod, asks an assistant to compare models that fit the available memory, and exposes an inference endpoint to his harness. He reports a candidate at about $0.22/hour, or roughly $158/month if left running continuously, and shows a working connection after setup. That was his example at the time of recording, not a current quote for every GPU, model, region or storage choice. Get the current price and expected VRAM requirement before creating anything.

RunPod's Pod documentation distinguishes stopping from termination. Stopping ends compute use but keeps persistent data; storage charges can continue. Terminating can delete Pod volume data. Set a cost alert and an explicit end time, then verify the Pod state and any remaining volumes in RunPod's dashboard. An agent saying “I stopped it” is not a billing receipt. Protect the endpoint with authentication and network controls before connecting it to a harness.

LM Studio: Local Inference, With a Real Boundary Check

The local route begins with your actual RAM/VRAM, disk space and operating system. In LM Studio, search for a model that fits, inspect the publisher and file format, download a compatible variant, load it, then test a few turns before connecting it to DeepSeek Harness through LM Studio's local server. Do not rely on a model name or a claimed tokens-per-second estimate; run a representative prompt on your own hardware and measure speed and output quality.

Mark reports about 105 tokens/second in his own local setup. That number depends on model, quantization, hardware, context length and whether the task uses tools. LM Studio's offline guide says downloaded-model inference and its local server can work without internet. Searching for or downloading models still needs connectivity, and a workflow that invokes Firecrawl or browses websites is not fully offline just because its model runs locally. Keep the inference server bound to localhost unless you have a deliberate, secured reason to expose it.

Downloaded Models Are Part of the Supply Chain

The video's final caveat is important. In a ProjectDiscovery demonstration, researchers modified a small open model so it behaved normally until a trigger caused an agent with broad access to disclose credentials. This shows a plausible failure mode; it does not mean every edited or “uncensored” model is malicious. The dangerous combination was untrusted weights plus an agent allowed to reach secrets, execute commands and contact the internet.

Before loading a model or plugin, check the publisher, license, file format, version and provenance. Treat popularity and benchmark scores as weak evidence of trust. Run unfamiliar models in a dedicated environment without real customer data or valuable credentials; restrict filesystem, shell and outbound-network access; and log tool calls. DeepSeek's own safety notice recommends a disposable VM or other dedicated environment and least privilege. A model without access to a secret cannot leak that secret through its tools.

A Safer First Brief for Your Own Staging App

Mark promises copyable setup prompts in the video's pinned resources. For a first defensive run, use a narrower brief than “attack this URL with every tool.” The following is an original, scoped template rather than a quotation from his video:

Review only my staging app at [approved URL]. I own this deployment.
Use the synthetic test accounts I provide, not real customer data.
Start with passive observation and normal user flows. Do not scan
other domains, guess credentials, brute-force, change data, or run
active vulnerability templates without my separate approval.

For each suspected issue, record the exact page or request, the
observed result, its likely impact, and what evidence is still missing.
Do not read or reveal secrets. Stop if the target redirects outside
the approved scope or a tool requests broader access. Give me a
prioritized report and a retest plan; make no production changes.

After reviewing the passive report, approve one specific active check at a time, with a request-rate cap and a test window. Verify the finding manually, patch in code or configuration, and retest. That sequence leaves a useful trail and prevents the agent from turning a vague goal into an uncontrolled live scan.

Turn the Demo Into a Reviewed Service Pilot

The potential business is not “point an uncensored model at any app.” It is a bounded review for an owner who wants evidence, human judgment and a retest after a fix. This original prompt tests whether that offer is useful to a reachable buyer; it does not turn an AI scan into a professional certification.

Video Chapters

Why and what

Route 1: hosted

Route 2: rented GPU

Route 3: local

Sources and Limits

• Video and transcript: Mark Kashef's walkthrough; the transcript was supplied with the article request.
• Harness and tools: DeepSeek Harness and its safety notice; Playwright MCP; Firecrawl MCP; Nuclei.
• Deployment and risk: RunPod Pod management; LM Studio offline behavior; ProjectDiscovery's edited-model research.

Mark's app result, quoted speed and quoted GPU price are his demonstrations, not measurements we independently reproduced. Tool features, prices and limits can change; follow current vendor docs before setup.