Lictor AI

Documentation · the knowledge base

Lictor, documented.

Lictor is open-source and Apache 2.0, and every one of its 48 checks is a readable markdown module you can open, audit and run before you trust it. This is the technical knowledge base: the front door to how the tool thinks, what it looks for, what it refuses to flag, and the standards it maps to. No marketing gloss here, just the documentation.

Source of truth: skills/lictor-security-check/checks/ · baseline CHECKS.md v2.2 · Apache 2.0 · runs 100% locally

Install in 60s → Browse the 48 checks →

Start here

Three minutes to your first finding

New to Lictor? Read these in order. They take you from "what is this" to a real SECURITY-AUDIT.md on your own project.

What Lictor is

A free, read-only, pre-release security audit you run from one slash command. It reads your code and observes what's already public. It never attacks a live system. Open-source, Apache 2.0, runs entirely on your machine.

Install in 60s

One command drops the skill into your Claude Code setup. No token, no signup, no telemetry.

Install the CLI →

Run your first scan

Point it at any project (AI-built or hand-written, web or mobile). It detects the stack, runs every applicable check, and hands back a plain-English report.

Run your first scan →

Reference · the 48 checks

Every check, as a readable module

The 48 checks group into 8 categories. Each one is a markdown file you can read: what it looks for, the severity, the OWASP/CWE mapping, and a built-in "what NOT to flag" guard. Open any check below, or read the full coverage overview first.

The full coverage map →

Group 1 · Secrets & exposure · 6 checks

Things that should never be public

CRITICAL

Secrets in code

Hardcoded API keys, passwords, DB connection strings in source or build output.

CRITICAL

Leaked AI keys · our specialty

OpenAI / Anthropic / Gemini keys shipped to the browser or committed to the repo.

Group 2 · Access control · 7 checks

Who can do what, and what they can see

HIGH

Mass assignment

Extra JSON fields that set role/isAdmin you never meant to expose.

CRITICAL

Open database

Supabase / Firebase with no security rules: the front-door key opens everything.

MEDIUM

Missing audit logging

No record of logins, permission changes, payments, so you can't detect or investigate a breach.

Group 3 · Injection & input · 5 checks

When your app trusts what the user types

CRITICAL

Injection

SQL / XSS / command / template injection from unsanitized input.

HIGH

SSRF

Your server (or AI agent) fetching attacker-controlled URLs / cloud metadata.

HIGH

Insecure file upload

Unrestricted uploads, traversal in filenames, paths to remote code execution.

CRITICAL

Path traversal

../ in a file path that lets anyone read arbitrary files.

Group 4 · Web hardening · 6 checks

The headers and gates the framework left off

HIGH

No rate limiting

Brute-force, and AI-endpoint cost-bombing that drains your wallet.

MEDIUM

Open redirect

User-controlled redirects used for phishing and token theft.

Group 5 · API-specific · 4 checks

The OWASP API Top 10, where the money usually is

Group 6 · Supply chain & integrity · 2 checks

What you pulled in, and how it ships

Group 7 · AI / LLM · 10 checks · our niche

The whole OWASP Top 10 for LLM apps

If you built it with AI, or it talks to a model, this is the part most scanners don't have.

HIGH

RAG ingestion trust

A knowledge base anyone can poison with documents the model later trusts.

Group 8 · Mobile · 8 checks

iOS, Android, Flutter, React Native

CRITICAL

Mobile core leaks

Hardcoded keys in the bundle, cleartext traffic, insecure storage, exported components.

MEDIUM

Privacy controls

Over-broad permissions, undisclosed tracking, clipboard and screenshot leaks.

Methodology & quality

Verify before you flag. Observe, never attack.

How Lictor decides what reaches you matters more than how many rules it has. Three principles govern every finding.

Verify before flag

Each finding is confirmed against a "what NOT to flag" guard before it reaches you, then rewritten as a plain-English story with a 5-minute fix and the OWASP/CWE mapping.

Near-zero false positives

A scanner that cries wolf is worse than none. We document every false-positive class we filter, learned the hard way, from real disclosures and triager responses.

The false positives we filter →

Observe-only boundaries

Lictor is read-only and local. It flags only what's confirmable by reading your code or observing what's already public. Anything that needs attacking a live system is out by design. That belongs to an authorized pentest.

The suite

One core, five surfaces

The slash-command scan is one way in. Behind it is a small suite sharing one engine, each piece documented on its own page.

Sentinel

The detection engine: the 48 checks, the stack detection, the false-positive filters.

Shield

Runtime guardrails for AI apps: prompt-injection and output-sink defenses for what you ship.

Guardian

The shared core both Sentinel and Patrol build on: the rules, mappings and reporting.

Patrol

The external observe-only scanner: what's already public on the open internet.

The CLI

The slash command that ties it together and writes your SECURITY-AUDIT.md.

Standards & compliance

Standards, not a homemade list

Coverage isn't a number we picked. The 48 checks map to the recognized external risk catalogs, so an enterprise buyer or compliance team can trace every finding back to a standard.

Read every check before you trust it.

Open-source, Apache 2.0, runs entirely on your machine: no token, no signup, no telemetry. The documentation is the product, and it's all here.

Scan your app → The 48 checks →