AI automation · first published on Medium, 27 May 2026 · updated 13 July 2026
How I turned myself into a chatbot
In short: the assistant in the corner of this website is an AI chatbot that only answers from approved facts about me and my work. It runs on Cloudflare for close to nothing, refuses to guess, and the code is open source. This is how it works and why I built it that way.
Why constrain it at all
Most professional websites lose enquiries to unanswered questions. A visitor wonders whether you cover their problem, does not find the exact sentence that says so, and leaves. A chatbot can close that gap, but the obvious way of building one creates a worse problem: a model that confidently invents answers on your behalf. If a bot speaks for you, a wrong answer is not a technical bug. It is your reputation, delivered politely.
So the design goal was the opposite of impressive: a bot that is boring in the best sense. It answers only from a set of approved facts, declines everything else, and hands the visitor a way to reach the real me. Given that my work is validating software and AI systems, the bot also has to be its own proof: a live, guardrailed example of what I build for clients.
How it is put together
There are two parts, and neither needs a server to look after.
The first is a Cloudflare Worker, a small program that runs on Cloudflare's network. It receives the visitor's message, checks the request is legitimate, builds a prompt around my profile, calls the language model, trims the reply, and sends it back. The model's API key lives in the platform's secret store and never appears in any code or page.
The second is the widget: one JavaScript file that draws the chat bubble and panel. It renders inside its own isolated container so it cannot clash with the styles of whatever site embeds it. Installing it on a site is a single tag before the closing body tag.
The part that does the work
The bot's knowledge is plain Markdown files: who I am, what I offer, how to reach me, the questions people actually ask, and a boundaries file listing what it must not discuss. At deploy time those files are bundled into a profile the Worker reads. Changing what the bot knows means editing prose, not code. That one decision is what keeps the bot honest and maintainable: the writing is the product.
Security, because it speaks for you
A public bot with your name on it will be poked. The protections are layered, and each one is small:
- Requests are only accepted from the website itself, and a token blocks calls that do not come from the real widget.
- Each visitor is rate limited, and message length and conversation length are capped, so neither abuse nor accidents can run up costs.
- Known prompt-injection phrasings are filtered before the model ever sees them, and the prompt enforces a strict hierarchy: system rules over profile, profile over visitor.
- Replies are trimmed on the server, and rejected requests get no helpful error details to work with.
None of these is clever on its own. Together they mean the bot cannot be talked into a new personality, and a bad actor gets nothing for trying.
What it costs
Cloudflare's free tier covers one hundred thousand requests a day, which a personal site will not approach. The only real cost is the language model itself, roughly a penny per thousand messages on the cheaper models. In practice the whole thing runs for less than a coffee a month.
Why I think it is worth building
For engineers, it is a clean little architecture: edge functions, a constrained model, secrets handled properly, and a widget with a footprint of one file. For everyone else, the point is simpler. The cost of having an honest, controlled AI assistant on your site has fallen so far that not having one is now a choice. The version worth having is the one that will not misrepresent you when nobody is watching.
Build your own
You need a free Cloudflare account, an API key from OpenAI or Anthropic, and about fifteen minutes. The project is open source at github.com/gilav115/portfolio-chatbot. The real work is not the setup; it is writing your profile and deciding your boundaries, which is exactly as it should be.