Lucid

Lucid is a VS Code and Cursor extension that works like a safety net. Every time you commit, it reads the change on its own and responds in one of three ways: a warning card, a short lesson card, or silence. When a change weakens a database rule (Supabase/Postgres row-level security), Lucid doesn’t just guess. It spins up a throwaway Postgres database in a sealed Modal sandbox, creates two fake users, Alice and Bob, and tries to break in, first with deterministic probes, then with a Muse Spark attacker agent. If Bob can really read or change Alice’s data, the card is marked PROVEN and shows: what happened before and after the change (“Before: blocked. After: allowed.”) the attack step by step a plain-English fix the user can paste straight into their AI tool