The security crew for apps you built with AI.

/lictor-security-check

The 60-second audit. Walks your project, runs 7 checks, writes a plain-English report.

# Inside Claude Code, from any project:
/lictor-security-check

# Output:
# 🔴 CRITICAL · Your Supabase service key is in
#     bundle.js line 1247. Anyone with the URL has
#     full database write access. Fix below.
# 🟠 HIGH · /api/users returns every row to any
#     logged-in user. Add RLS policy.
# 🟡 MED · Stripe webhook unsigned. (5 more...)

• 7 checks tuned for Lovable / Bolt / v0 / Cursor / Replit patterns
• Plain English — no “information disclosure vulnerability,” just “anyone can read your customer list”
• Three sibling skills: /lictor-explain, /lictor-fix-it, /lictor-rotate
• Runs 100% local. No token, no signup, no telemetry, no per-seat pricing

Lictor Shield

Audits any deployed AI-built site you visit. Catches the issues before you sign up.

• Detects Lovable / Bolt / v0 / Next.js / Supabase fingerprints on any URL
• 5 static checks: leaked secrets, exposed DB, open auth, CORS, AI-agent surface
• Local-only — no URL ever leaves your browser
• Real-time alarm when an AI agent on the page touches your cookies

import { wrap } from "@lictor/sentinel";

const client = wrap(new OpenAI(), {
  preflight:  ["prompt-injection", "secrets-in-input"],
  postflight: ["pii-leak"],
});

// Same call site. Same response shape.
// Sentinel intercepts pre + post.