Why I’m Building LyraSec AI

I've spent the last few months building Lyrafin AI almost entirely with AI coding tools. It shipped faster than anything I've built before. It also made me nervous in a way I didn't expect — not because it broke, but because of what it would take for me to notice if it broke in the wrong way.

Every AI coding assistant I've used is genuinely great at making code that works. Not one of them has caught the SSRF hole or the missing auth check on its own — that part is still entirely on me.

🔎 What I went looking for — and couldn't find

I went looking for a tool that would sit inside the loop I actually work in: Cursor, Claude Code, CI. Something that would tell me, in plain language, what was actually wrong and how to fix it — not a PDF audit that lands six weeks after ship. I couldn't find it. So I'm building it.

⚙️ What LyraSec AI actually is

One loop — target, scan, verified finding, fix PR, retest, report — that works whether you're a solo builder or a team that needs SSO and audit logs. Every piece of this already exists somewhere, done well, by people I respect. What doesn't exist yet is all of it in one place, built for how code actually gets written now.

📍 Where things actually stand

Auth, dashboard, project setup, RBAC, audit logging, SSRF hardening — done. The scan engine is next. I'd rather tell you that honestly than oversell where we are.

🍳 Eating my own cooking

Before this goes near anyone else, I'm running it against Lyrafin AI's own codebase first.

📡 Following along

Building this in public from here. More soon.