FREE · NO SIGNUP · PASSIVE ONLY · YOUR URL NEVER LEAVES OUR WORKER

Paste a URL. Get a security grade.

Free public scanner for AI-built apps. Built for projects deployed from any AI-generated app, but it works on anything public. Takes about 30 seconds.

Free, passive surface check of HTTPS, security headers, and exposed files, graded in plain English. No signup, no telemetry. Want a deep audit of your code? Run the free /lictor-security-check skill in Claude Code.

Here's what a scorecard looks like.

Below is a sample scan of lictor-ai.com itself. We scan ourselves first, publicly. Our findings are public. That's the contract.

See the full scorecard for lictor-ai.com →

How it works.

You paste a URL.

Any public web app. No login, no GitHub install, no signup.

A Cloudflare Worker scans it.

Our 7-check Rust engine, compiled to WebAssembly, runs against your URL in about 30 seconds. The same engine behind /lictor-security-check and Lictor’s Patrol monitoring.

You get a letter grade.

A through F. Plus the 5 worst findings in plain English, with a 5-minute fix for each. Shareable. Re-runnable as you fix.

What we do with your scan.

We never store your URL or scorecard publicly without your consent. Your scan is yours.
We store one anonymous fingerprint per scan, a hash of (check + severity + platform) with no URL, no app name, no PII. This builds the public dataset on how AI assistants get security wrong.
Patrol (our continuous scanner) respects a 30-day private-disclosure window for individual founders and 90 days for companies.
One-click opt-out at lictor-ai.com/scan/<hash>/remove. Meerkat processes it within 24 hours.
Zero telemetry, ever. The skill-suite audit is also free and runs entirely on your machine.

Or run it locally. 2 commands, 30 seconds

Prefer to run inside your editor instead of pasting a URL? Lictor ships as a Claude Code plugin. Paste 2 commands and type /lictor-security-check in any project.

# 1. Add the Lictor marketplace (inside Claude Code)
/plugin marketplace add Raffa-jarrl/Lictor-AI

# 2. Install the skill suite
/plugin install lictor-security-suite@lictor-ai

Then open Claude Code in any project and type /lictor-security-check

It's free. Forever.

The Lictor skill suite is open source under Apache 2.0. The URL scanner runs on Cloudflare Workers ($30/month at our projected volumes) and a domain (one-time). The audit, the public scorecards, and the leaderboard are all free.

If Lictor helps you ship a safer app, the world treats back the same:

Star the repo

Want your domains and repos watched continuously, with alerts when something opens up? That's Lictor for Business, hosted monitoring from $49/month. (See the plans.)