We said MAYBE on August 25, 2026. Not settled — due August 25, 2027.
Read this with the caveat. We tested the engine that produced this verdict against 292 launches whose outcomes we already knew, and could not show it predicted which survived. Some of its data sources were also dead at the time of scoring. The verdict stays up, dated and unedited, because a record you can quietly revise is not a record — but it is worth less than it looked when it was written.
Demand is proven commercially but entirely at the top of the market — five funded incumbents plus two YC startups charging money, with zero organic community pull and no keyword signal. The gaps identified all point at indie developers, the segment least likely to pay for security tooling, while the parts of the market that do pay are guarded by procurement, compliance expectations and vendor trust a solo founder cannot shortcut. Lean SKIP unless you narrow hard to LLM/RAG app security and sell to AI teams, not indie devs.
Five established competitors are successfully charging money for app security scanning, and two YC-backed launches on HN in this exact space show live commercial and investor pull — but there is zero grassroots signal (0 Reddit posts) and no strong keywords, meaning demand is real at the enterprise budget level, not at the indie-dev level the gaps describe.
The incumbents are not indie shops — they are heavily funded platforms (Snyk, Checkmarx, Sonar) plus fresh YC-backed entrants (Escape, Corgea) already attacking the same 'AI auto-fix' wedge, and security is a trust/procurement-gated purchase where a solo unknown vendor is structurally disadvantaged. The one genuinely open lane cited — lightweight scanning for LLM/RAG apps — is real but the paying buyer there is a security team, not the indie dev who is named as the target and historically does not pay for security.
The strongest case for building: 'security for AI/LLM applications' (prompt injection, RAG data leakage, plugin permissions) is a genuinely new attack surface that none of the five cited incumbents were designed for, and a solo founder shipping a one-click scanner for that specific surface could own an SEO/content lane before Snyk-class vendors bolt it on. That wedge is narrow enough that a single person can be credibly best-in-class within weeks.
What is worth more than this page. The register records what became of 6,266 real launches. No engine has to be right for that to be true.