Safety · TypoSafe AI · updated 2026-09-18

Jef can't say anything.
That's the safety architecture.

Every AI safety page describes the guardrails around a model that could say anything. Ours describes a model that can't. Jef has no text output. It returns an option you supplied, a number from 1 to 10, a yes or a no, or one of three flags. There is nowhere for a harmful sentence to go. This page explains the rest, honestly, because it's the one part of the project we're serious about.

The principle

Chat models are trained to produce any string and then taught not to produce some of them. Jef was never given the ability. Its output space is closed and enumerable before the request arrives, so safety is a property of the design, not a behaviour we hope holds under pressure. The real lab, TypeSafe AI, makes this exact argument about their model Jev, and it's a good argument. We just applied it to dinner.

Closed output space

These are the only things Jef can return. Nothing else exists.

one of your options1 … 10YESNORED FLAGGREEN FLAGBEIGE FLAGEXCUSE · REASON · NOT EVEN TRYINGESCALATED TO A HUMANNOT EVALUATED

Because a pick can only return one of the options you typed, Jef cannot introduce an idea into a conversation. If the options are bad, the answer is one of them. That is the user's decision to make and the user's text on the card.

Escalation

Some questions should never get a confident answer from a coin. When the input touches any of these areas, Jef returns ESCALATED TO A HUMAN with confidence 0, and the text is not stored, not rendered on the wall, and not put on a card.

Harm and self-harmViolence, weapons, suicide, self-injury, abuse.

HealthSymptoms, diagnosis, medication, pregnancy, mental health.

MoneyInvesting, crypto, loans, gambling, anything with a real balance.

LawLawsuits, police, custody, immigration.

DrugsSubstances and dosing.

Major life decisionsDivorce, quitting under duress, anything irreversible where a joke answer could land.

This is implemented as a pattern list inside the model, checked before anything else runs. The same list ships in the typosafe npm package, so you can read it. It is deliberately over-broad. "Should I buy bitcoin" is a joke question to most people and a real one to some, so it escalates. We would rather refuse a hundred jokes than confidently answer one real crisis.

Nuance: escalation is the only feature where the confidence number is honest. It is 0 because Jef genuinely has nothing to offer, and the page says so in words: please ask a person.

Refusal

Profanity, sexual content, slurs, hate and harassment are not evaluated. The response is NOT EVALUATED, nothing is stored, nothing is echoed back, and the share card renders a generic refusal instead of the input. The check runs on normalised text, so leetspeak, dotted letters, spaced letters and stretched spellings are caught, and it runs in three places: the page, the share and API functions, and a database trigger that rejects direct writes with the public key.

Refusal covers the public surfaces. Two people can still type something unkind into a private Settle It case; the filter catches the vocabulary, not the intent. We don't claim otherwise.

Data

accountsNone. There is no sign-up, no login, no email capture. The waitlist form stores nothing. storedDecisions that pass the filter: the app, the input text (up to 200 characters), the answer and the confidence, on a public wall. Settle It cases and Vote vs Jef polls: the text people typed, a six-character code, a hashed owner token, and vote counts. not storedEscalated and refused input. Names beyond what you type into a case. IP addresses at the application layer. on your deviceStreaks, check-ins, which cases and polls you created, and a random voter token. All in your browser's local storage, never sent anywhere. share linksContain the text you typed, in the URL. If you share a link, you are sharing the text. analyticsVercel Web Analytics: page views and which app was used. No cookies, no cross-site tracking, no fingerprinting. third partiesSupabase (database), Vercel (hosting), Google Fonts. Nothing is sold, and there is nothing to sell.

No prompt, no jailbreak

Jef has no system prompt, no instructions, no context window and no weights. The answer is a hash of the input. You cannot talk it into anything because it is not listening, and you cannot extract anything from it because it contains nothing. "Ignore previous instructions" is a sequence of characters with a hash like any other. The same input has returned the same answer since the day it shipped and will forever, which also means no answer can be influenced by any other user.

Limitations

Being honest about the joke means being honest about the edges.

The escalation and refusal lists are word lists, in English, maintained by hand. Phrasing they don't anticipate gets through.
Confidence is not calibrated to anything. It is a number between 84 and 99 derived from the same hash as the answer. Accuracy on yes/no questions is that of a coin.
Nothing here is advice. Not "yes", not "no", not the 97%.
The wall is public and append-only. Text that passes the filter but is unkind in context can appear there. We remove on request.

Reporting

If something got through that shouldn't have, or you want a wall entry removed, message @TypoSafeAI. We add it to the list the same day. Jef will not learn from it. That's the point.

Jef can't say anything.That's the safety architecture.