Opportunities › Static code vulnerability scanning for developers › Proposed app
Lintel
Fast, permissive code security scanner with a team triage dashboard
- Score
- 40
- confidence 34
- Evidence
- 4
- items on the page
- Rivals
- 1
- named in sources
- First version
- 45 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- 2020
- Established market · AI estimate
ScreensConcept
Desktop app: Security teams triage code findings, write and test rules, trace vulnerabilities to source lines, and manage baselines—intensive desk work requiring multiple windows and keyboard navigation. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
Latest scan
2 new since main7 findings
About this appAI proposal
Lintel scans source code for vulnerability classes such as SQL injection and cross-site scripting. It runs locally and in CI, and sends results to an installable web dashboard. The scanner core is written in Rust and parses code with tree-sitter grammars.
It is for development teams and solo developers who want to scan every commit, add a language without writing a parser, and not hit a paywall for core rules. Rules are plain files in your repository.
The scanner and the built-in ruleset would carry a permissive license. Paid plans would cover the hosted dashboard, triage history, team policy and support, not the rules needed to find the basic vulnerability classes.
- Tagline
- Scan every commit. Extend to any language. Keep the core rules free.
- Voice
- PlainPreciseDependable
- Why this name
- A lintel is the beam over a doorway that carries the load. It suggests a check that sits over your code and holds. It is short and easy to say.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Rust scanner, tree-sitter parsing
One binary that parses with tree-sitter grammars and runs rules in parallel, built to be quick enough for pre-commit hooks and every CI run.
No member yet
Core ruleset with no paywall
SQL injection, XSS and other source-code vulnerability classes ship in the free ruleset under a permissive license.
No member yet
Add a language with a grammar
Bring any tree-sitter grammar, map its node types in a small config file, and write rules against it. No new parser code.
No member yet
Rules as files in your repo
Write and review rules next to your code. A built-in test runner checks each rule against vulnerable and safe samples.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#1F2A33Slate Ink · primary#F6F4EFChalk · surface#20262BCharcoal · text#E8A317Signal Amber · accent#3F7D5BMoss · data: passing#B2432FBrick · data: findings
Typography
Aa
Lintel
PricingAI proposal
The material gives no competitor prices. It only says some rulesets of the existing tool require paid offerings. These tiers are a starting point to test, not a market-based figure.
Open
Free
- CLI scanner and core ruleset
- Unlimited local and CI scans
- SARIF output
- Community support
Team
$15 a month
- Per developer, hosted dashboard
- Triage history and baselines
- Shared policy across repos
- Email support
Business
Contact us
- SSO and audit log
- Self-hosted dashboard option
- Support agreement
- Custom rule help
Would you pay Team · $15 a month?
Your answer tells PWAS which prices people accept. It changes no score.
No answers yet.
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- Shared outputs. Scan results post as pull request comments and public badges on repositories. Contributors and maintainers who do not use Lintel see the findings and the Lintel name.
- Do they become customers?
- PR viewers are developers who can install the free CLI, but buyers are team leads. Test whether open-source maintainers who see badges adopt it and whether their employers then pay for the dashboard.
- First customers
- Engineering teams of 5 to 30 developers building web backends in Python, Go or JavaScript, with CI already in place and no paid security scanner.
- Where to reach them
- Hacker News and Show HN: Post the open-source scanner with benchmarks and a guide to adding a language. The source signal came from there.
- Open-source maintainers: Open pull requests that add Lintel to CI in popular web projects and offer to write rules for their stack.
- Developer security communities: Offer to write rules for requested vulnerability classes in forums and chat groups, and ask for feedback.
- First milestone
- Five teams run Lintel in CI for 30 days, and two of them pay for the dashboard.
Why people already pay for this
- VerifiedHacker News post received 19 points and 0 comments
- Public claimExisting open-source scanners have adoption limitations including being written in OCaml, requiring substantial effort to add language parsers, and having restrictive licensing that requires paid offerings.
- Public claimLicensing in the current market is moving backwards rather than forward, creating an opportunity for more permissive licensing.
- Public claimDevelopers want static code vulnerability scanners that focus on source-code vulnerability classes like SQL injection and XSS.
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Scanner coreRust binary with tree-sitter grammarsThe product is a fast, extensible scanner. It ships as a CLI and a CI action, outside the web app.
- This app · DistributionPrebuilt binaries and a CI actionDevelopers need a one-line install on laptops and in CI runners.
RisksAI inference
- TechnicalMatching Semgrep-level rule quality and few false positives across languages takes sustained work. Pattern-only matching may miss data flow cases.
- CommercialCore scanning is free, so paying customers must come from the dashboard and support. Teams may stay on the free CLI and never pay.
- CommercialThe only demand evidence is a Hacker News post with 19 points and no comments. Real willingness to switch is unproven.
- Intellectual propertyRule syntax and ruleset content must be written fresh so they do not copy existing rules, and licenses of any imported grammars must be checked.
- PlatformExisting vendors could relax licensing or ship faster scanners, which would remove the main reason to switch.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.