Lictor AI

Guardianship, nature, and the architecture of trust.

PUBLIC GOOD · APACHE 2.0 · NO PAYWALL EVER

Lictor exists to protect the people who build with AI: founders, hobbyists, students, anyone shipping code they didn't fully write. The scanner is free. The CLI is free. The standard is free. None of that will ever change.

What Lictor has done so far

276

verified vulnerabilities responsibly disclosed (184 GitHub-public + 92 direct-email CVD)

7,736

external hosts scanned in May · 12 countries · 5 industries

scanner modules across 8 attack-surface categories (Firebase, DB-creds, PR-target, sourcemap, email-auth, cloud-bucket, RDP/SMB, TLS & more)

GitHub Security Advisories filed

The most useful ways to help

These matter more than money. Money keeps the lights on; this is what makes Lictor better.

⭐ Star the repo

It's the only number that helps Lictor get discovered. Takes 4 seconds.

github.com/Raffa-jarrl/Lictor-AI →

🐛 File a false-negative

If Lictor missed a real bug in your code, it's the most valuable kind of issue we can get. We fix and credit.

Open false-negative issue →

🗣 File a voice-bug

If a Lictor finding sounded too jargony, that's a bug. Voice is the product. We rewrite and credit.

Open voice-bug issue →

🔍 Contribute a pattern

If you know a vibe-coder security pattern we haven't tuned for yet, send it. Public repo URLs in the wild are best.

Suggest a pattern →

📣 Tell a builder

Know someone shipping an AI-generated app? Send them lictor-ai.com/scan. Free, 30 seconds, no signup.

Tweet about Lictor →

💻 Write code

Rust check authors, Tauri front-end, browser-extension hackers, technical writers are all welcome. Start with good-first-issue.

Browse good-first-issues →

If you'd rather give money

Two options. Both go directly to the maintainer. No middleman, no overhead, no "operational floor" theatre.

Monthly or one-time

GitHub Sponsors

$5 / $15 / $50 / mo

The OSS standard. 0% platform fees through 2026. Best for recurring support.

Sponsor on GitHub →

One-tap via PayPal

Coffee & Soda

Lowest-friction. Pay with PayPal balance, card, or Apple Pay. Add a note. Raffa reads every one.

Send via PayPal →

Why we chose this model

The security industry runs on fear-rent, selling protection at the price the market will bear when someone is panicking about a breach. We don't want to be that. Vibe-coders are exactly the audience priced out of every existing security tool, and they're the audience most likely to ship a bug that hurts real users.

So Lictor's core stays free, forever. Voluntary support from the people it helps keeps the maintainer fed. A small commercial tier (Lictor for Teams) funds the rest. It's for organizations that want continuous monitoring and audit-log export. The free tier already does everything a single builder needs.

Raffa

Standing on the shoulders of

Lictor is built with these communities, and contributes back to them.

OWASP Apache 2.0 Cloudflare GitHub Rust Next.js Tauri Supabase

However you help, thank you.

And if you don't, use Lictor anyway. That's why it exists.