Local First Lab
Hands-on comparisons of privacy-respecting, self-hostable software: the open-source apps that replace surveillance SaaS and keep your data on your own hardware.
New flagship: lanewatch, a btop-style terminal monitor for local inference servers and the cloud assistant lanes running on your machine. Python stdlib only; readings are numbers, never content. The story →
Security engagement: Hardening Loop, a security engagement that ends at proof each finding is fixed, not a PDF that gets filed. See how the loop works →
I also build these systems for clients: see the supervised-ops demo.
2026-07-25 · lanewatch security pass a hostile endpoint could paint 2,000 cells with 8 bytes or drive memory to 1.3 GB with one 137 MB reply. both fixed in code and pinned by 25 security tests. 2026-07-17 · task-success bench, 14 browser goals hand-written, ceiling │ 14/14 36B local model, on-site │ 3/14 (baseline 0/14) 4B local model, on-site │ 2/14 (baseline 0/14) authoring validity │ 14/14 wire format, not model scale, drove the dominant failure. full data: lab results on GitHub type bench in the terminal to watch a run
you@localfirstlab:~$ replace "AdBlock Plus" → adguard ● self-hosted: your data stays home you@localfirstlab:~$ ▏
What this lab actually ships
Lab log: 2026-07-25: adversarial security pass on lanewatch, proving a hostile local endpoint could repaint the terminal or balloon memory to 1.3 GB, then fixing both and pinning 25 security tests. Before that, 2026-07-17: task-success bench, a 4B and a 36B local model across two conditions (2x2) over 14 scripted browser goals: authoring validity 14/14 everywhere, task success 0-3/14. Wire format, not model scale, drove the dominant failure. Full results →
What your browser just told us
Any site you visit can read a stack of signals the instant the page loads: no cookies, no permission prompt. This page is no exception. The difference is what happens next.
Supervised AI systems for small businesses
I design and install AI operations systems where a human approves every outgoing action (inquiry triage, drafted replies, follow-ups, audit trails). Fixed-price pilots from $500. Try the interactive demo.
Try the interactive demo → Or email hello@localfirstlab.orgWhat are you overpaying for?
Check the subscriptions you already pay for. We'll tally the annual cost and show the self-hosted alternative already in our catalog, right next to it. Prices are 2026 estimates for common individual/family plans; yours may differ.
Honesty note: self-hosting isn't free. It costs your own time (setup + upkeep) and hardware/electricity: a different bill, not a $0 one. Figures above are estimates for the subscription side; your mileage on both sides will vary.
Want it set up without the headache? See how we do this for people → or email hello@localfirstlab.org.
lfl-terminal: a terminal for your browser
A Chrome extension that drops a command line onto any site: known commands run deterministically, anything else becomes one action a local model proposes and you approve before it touches the page. Open core, Apache-2.0, early (v0.5.x, Chrome only, load-unpacked for now).
See it in action → GitHub →Compare all 71 alternatives in one table →
Need this set up for you?
I do self-hosting migrations, privacy stack audits, and private/local AI installs, including for confidentiality-bound firms. About me · GitHub · Get in touch