Evidence over promises

How LyraShield AI started

After processing 6.8 billion tokens across 2,728 AI coding sessions, our founder noticed something: the most-used tool in his AI workflow wasn't a scaffolding generator or a UI builder — it was a security review plugin, run 232 times. The insight was simple: AI can write code quickly, but most review processes haven't adapted.

Traditional security tools were built for human-written code with human review cadences. AI-generated code changes the equation: code arrives faster, patterns are different and the review bottleneck shifts from "who writes it" to "who verifies it." LyraShield AI was built to close that gap with a methodology that preserves evidence provenance, coverage limits and retest state as separate, inspectable facts.

Our mission

We do not claim that a clean scan proves an app is secure. We do not claim universal coverage. We record what was checked, what a fresh retest confirmed and what remains uncertain — then produce a checksum-bound report that stakeholders can inspect. The Vibe Security 50 framework defines 43 code/URL review controls and 7 that require operational or human evidence outside the scan, so you always know the boundary of what a scan can and cannot establish.

Our approach

Evidence states

Every finding carries one of three shipped states: detected, retest-confirmed or inconclusive. The schema also defines a fourth state for a future separate verification step; no finding is in it today. A score never overrides these facts.

Coverage receipts

The Vibe Security 50 framework records per-control coverage: completed, limited, skipped or not-applicable. You know exactly what was and was not checked.

Deterministic retests

When a fix is applied, a server-owned deterministic retest checks whether the condition is actually absent — not just whether the scanner stopped reporting it.

Checksum-bound reports

An assurance report is a private snapshot written once per scan and report type, bound to a recorded sha256 manifest checksum. The checksum is verifiable, so a shared report can be checked against what was recorded at creation.

Founder

What we believe

• 01

  A clean scan is not a security guarantee. A score is an interpretation aid derived from evidence. It does not override the underlying findings, coverage limits or retest receipts.

• 02

  Coverage is a fact, not a feeling. Which checks completed, were limited, were skipped or did not apply — including retained limitations — must be visible on every report.

• 03

  Evidence states are not interchangeable. Detected, retest-confirmed and inconclusive are separate states with distinct meanings. Scanner confidence alone never confirms a fix; only a fresh retest does.

• 04

  Fix PRs open only after a human approves. A Fix PR carries a server-generated patch bound to that approval. Connected OAuth clients can run only operations within a browser-confirmed grant, checked again at execution. Nothing auto-merges.

• 05

  AI-built apps need AI-aware security. Agent rule injection, MCP misconfiguration and prompt-injected code paths are real risks that traditional SAST tools were not designed to catch.

Contact

For a security vulnerability, follow the coordinated disclosure process so the report reaches the monitored mailbox with the detail we need. For help and product questions, email support@lyrashieldai.com. Registration is open in the beta — Start free trial to start a launch report.