Daily security briefing, written and sent by itself

A security firm in Nairobi needed its field teams to start the day knowing what happened overnight. Producing that meant someone reading a dozen sources by hand every morning, before anyone had time to do it properly.

Now it runs by itself at 05:45 Nairobi time.

The pipeline collects from Kenyan news outlets and government travel advisories, discards what it has already seen, uses a small model to classify each item into incidents, and then a larger model to write the briefing: national risk level, incidents by county, sector-by-sector exposure, work posture guidance, and upcoming events worth planning around. The result is rendered to PDF and emailed. Nobody presses anything.

Self-hosted on a VPS I set up and configured: n8n behind Traffic with automatic TLS certificates, a Postgres vector store for deduplication and history, and a headless Chromium service for PDF rendering, all in Docker.

Running cost is about $34 a month. Getting there meant rejecting a self-hosted scraping stack that would have needed five more containers on a single-core box and would still have failed on the government sites, which sit behind bot protection - the hosted free tier handles them and costs nothing.

Three failures in this build were silent rather than loud, which is the dangerous kind:

Deduplication ate everything. Items were written to the database before the deduplication step queried that same table, so every item matched itself and was discarded. The pipeline produced zero incidents, quietly, on every run.

The model's answer was read from the wrong place. On longer prompts the model emits a reasoning block first, so reading the first block of the response returned nothing - with no exception thrown. A short test prompt never reproduced it; only the real payload did.

The briefing was being truncated and delivered anyway. A token limit cut the report off mid-table, and it was then stored and emailed as though it were complete. It now fails loudly instead of shipping a half-written advisory.

A recent run: 67 items collected across five sources, 9 incidents classified, a 9,000-character briefing at ELEVATED risk level, delivered as a PDF by email. It has been running on schedule since.