Mertcan Sağlam

There's a specific moment that happens with almost every project: the agent produces code, it passes your tests, everything's green, and there's a real pull to just move on to the next thing. Totally understandable, the whole appeal of this workflow is speed.

But there's a gap between "this works" and "I understand why this works," and that gap is where the real risk hides. Not because the code is wrong, most of the time it isn't, but because the next time something breaks nearby, you're debugging code you never actually read closely the first time.

during the BC (before ChatGPT) era, this gap barely existed. You wrote it, so you understood it, mostly by necessity. Now understanding is a separate step you have to choose to take, not something that comes free with writing the code yourself.

One habit that closes that gap fast: before merging anything non-trivial, ask the agent to explain its own implementation back to you, line by line, in plain language. Not as a formality, actually read the explanation. Two things tend to happen. Either it confirms your understanding and takes thirty seconds, or it surfaces an assumption you didn't know was baked in, which is usually the more valuable outcome.

built this with two co-founders in Istanbul. the short version: you point your app at us instead of OpenAI/Anthropic/Gemini directly, we strip customer data, API keys, and other stuff that shouldn't leave the building out of the prompt, then forward it to whatever model you're using. under 100ms added latency. also gives you an audit trail if anyone ever asks "prove this was handled properly" (KVKK, GDPR, EU AI Act all want that answer eventually).

started building it after watching teams, including ourselves, paste real customer data into prompts without a second thought. figured there should be something sitting in between that catches it automatically instead of relying on everyone remembering not to.

we're mid build right now, MCP traffic support just landed alongside the LLM gateway. would love feedback from anyone dealing with this problem, or just tell me I'm wrong about something, that's useful too.

I'm one of three co-founders at SHIM. we build a gateway that sits between your app and whatever LLM you're calling, scrubs PII and secrets out of prompts before they leave, and keeps an audit trail for the compliance people who ask uncomfortable questions later (KVKK, GDPR, EU AI Act).

started this because we kept seeing teams paste real customer data into prompts without thinking twice about it, ourselves included at some point. now it's the thing we work on full time out of Istanbul.

not here to pitch, mostly want to meet people building things and hear what you're working on. happy to talk shop on LLM infra, PII detection, or why our mascot ended up being a shrimp (they're small and they clean everything, felt right).

what are you building?