Tuora
In-flight code interceptor for vibe-coded products
Hey everyone, it’s time for a transparent update on what I've been building. I've officially pivoted.
Previously, I was heads-down working on ScrubZero, a local, browser-based PII redacting tool. I still believe in the importance of that mission, but while building, I tripped over a much larger, more urgent problem in the modern development workflow that I simply couldn't ignore.
The AI-Coding Blind Spot
We are in an incredible era where AI-assisted development allows citizen developers to build and ship at lightspeed. But as I was building, I realized a massive gap in this new workflow: just how secure is this "vibe-coded" output?
The reality is that most citizen developers have a severe lack of understanding regarding the vulnerabilities hiding in their generated code. When I looked to the market for a solution, I hit a brick wall. The existing AppSec products are built for enterprise—they come with incredibly steep learning curves, complex integrations, and enterprise-level pricing that immediately locks out indie hackers and lean teams.
Enter Tuora
That friction is why I pivoted to build Tuora.
Tuora is an in-flight code security interceptor designed specifically for citizen developers and vibe-coders. It bridges the gap between rapid AI-assisted creation and necessary security. It ensures that the product you are building is secure enough for your own immediate use, and robust enough to actually scale without collapsing under technical or security debt.
Where we are today
The core is built, completely open-source, and ready to experiment with. Our current MVP is already powerful enough to catch critical vulnerabilities by covering:
Industry Standards: Full mapping against OWASP (Open Web Application Security Project), CWE (Common Weakness Enumeration), and MITRE ATLAS (AI-specific threat framework) frameworks.
Custom Protection: Powered by our own proprietary threat signatures designed specifically for AI-generated code patterns.
This is just the baseline—Tuora is built to expand far beyond these initial frameworks as we scale.
CLI Compatibility & Availability: To make adoption frictionless, the Tuora CLI is built to run where you already code. It currently natively supports:
Linux (Native & via WSL2)
macOS (Both Intel and Apple Silicon architectures)
What's Next: Tuora is currently free to use while we refine the core engine with the community. Moving forward, we are actively developing a paid tier for serious users and teams that will provide deeper, actionable intelligence analysis on your codebase.
If you are building with AI and want to ensure your code isn't a ticking time bomb, the tool is open for you to try at https://runtuora.com. I'd love to get your feedback on the setup!
Hi Indie Hackers,
I’m a Product Designer, and for a long time, I’ve carried a specific kind of "copy-paste anxiety." It started years ago while I was working at a large consultancy, where I watched firsthand as a single, innocent AI prompt turned into a major data leak. Ever since that day, that nagging fear has stuck with me every time I use an LLM.
The breaking point came recently when I found myself wasting an entire evening manually scrubbing a document just so I could safely ask an AI for help. It was soul-crushing work. When I went looking for a tool to help, I realized that it’s surprisingly hard to find something that just does one thing well.
Most of what's out there is either over-engineered SaaS product or sketchy "privacy" wrappers that require you to upload your data to "their" servers to be cleaned.
In turn, which just replaces one trust problem with another.
So, I built ScrubZero.
It acts as a smart, local filter that redacts names and bank details before they reach the AI or served as a template. Paste your text, and ScrubZero handles the detection automatically. You can then manually refine the tags for a more precise redaction, ensuring every piece of data is safe before it leaves your machine.
Think of it as a "safe room" for your data. Because the cleaning happens entirely on your own device, your private information never actually touches the internet.
Since this is an early build, I’m actively refining the detection logic to make it as bulletproof as possible and I’d love your help in stress-testing it.
You can try it out here
To submit a feature request, you can do it here
-
2
Most people have experienced that "copy-paste anxiety" where you realize halfway through an AI prompt that you've accidentally included a client's full name or a sensitive project ID. It is incredibly stressful to think that a simple request for a summary might have just permanently added your private company data to a model's training set. Since you are positioning ScrubZero as a "safe room" that runs entirely in the browser, how do you balance the heavy processing required for high-accuracy PII detection with the performance constraints of a local, client-side environment?
-
1
Exactly. That anxiety eventually turns into self-doubt about what else you might have missed before ingestion.
Currently, ScrubZero uses a two-step approach:
Rule-based identification handles the obvious patterns first, followed by a local AI model that looks at contextual proximity to catch the nuances. It works well for standard documents, but I’ve kept manual tagging as a core part of the UX for those edge cases AI might miss.As for heavy processing, I'll be honest.. it isn't there yet. Large CSV datasets are still a challenge in early testing, but those hurdles are helping me refine the redactor worker and see exactly how far we can push WebGPU.
-
1
That two-step logic with WebGPU is a clever way to keep things private without sacrificing too much speed.
It sounds like you are hitting the exact same bottleneck many technical founders face when trying to keep things local because optimizing that redactor worker is what actually builds long-term user trust.
By the way the way I work with digital PR and media placement can help bridge that trust gap even further since high authority features on sites like Bloomberg or AP News give privacy tools the institutional credibility they need to scale.
Keep pushing those WebGPU limits because the local first niche is definitely where the savvy users are heading.
-
-
5 Comments
I find pivots interesting when they look like a change of direction but feel more like a change of scale.
Reading this, I wasn't sure whether you abandoned the original problem.
Or whether you discovered a larger version of it.
It is a complete pivoting where my previous idea opened up the lead to the current direction. It was through feedback that drove the decision.
It took one feedback that goes like this "PII could be a good niche until every LLM providers come out with their inline redacting tool. How are you going to move on from there"
Seeing the bigger picture is important during pivoting phase. That gave me the courage to make the decision and move on.
That's the part I'd be most curious about.
Not the pivot itself.
The amount of influence that particular piece of feedback ended up having on the decision.
Sometimes a comment is valuable because it's correct.
Sometimes it's valuable because it changes which questions a founder starts asking next.
Those aren't always the same thing.
I've got a few thoughts on that, but it's probably more than I'd try to unpack properly in a thread.
What's the best email to reach you on?
You can reach out to be at me at byleonardlim dot com and I did happy to connect with you how the decision is made.
Hope to hear from you,Aryan!
Just sent a note to me@byleonardlim.com.
Looking forward to the discussion.