In October 2024, Sundar Pichai told investors that more than a quarter of all new code at Google was being written by AI. It became one of the most repeated numbers in technology. By April 2026, Google said the figure had reached 75 percent. 

Everyone quotes that number. Far fewer people ask the question that follows it: if machines are writing three-quarters of the code, who is reading it? In Bengaluru, an 18-year-old founder named Dominic Paul decided that question was worth building a company around. The answer is  Wyro , a tool that reads the backend of a software application and checks its architecture, the part of the code that decides who is allowed to reach your data.

The Arithmetic Nobody Wanted to Do

The excitement around AI coding is easy to understand. In February 2025, Andrej Karpathy, a founding member of OpenAI and former head of AI at Tesla, coined the phrase "vibe coding" for building software by describing it to an AI and barely looking at the code. By November, Collins Dictionary had named it its Word of the Year. A month after Karpathy's post, Y Combinator revealed that a quarter of the startups in its Winter 2025 batch estimated that more than 95 percent of their code was written by AI. 

Dominic looked at the same numbers and saw a different story. "Everyone celebrates how fast AI writes code," Dominic says. "But human review didn't get any faster. If machines keep writing more and people can still only read the same amount, the share of code that nobody has read goes up every single month. That isn't an opinion. It's arithmetic." 

For nearly three decades, open-source software has leaned on Linus's Law, Eric S. Raymond's famous line that "given enough eyeballs, all bugs are shallow." It is one of the most revered ideas in software. It also quietly assumes there will always be enough eyeballs. When code arrives faster than people can read it, that assumption is the first thing to break. 

The Turning Point That Changed Everything

Wyro did not begin as a checker. Dominic wrote its first line of code in March 2026, while in Class 12 at St. Joseph's Pre-University College in Bengaluru, and has built every part of it alone. The first version was a backend compiler: draw or describe the design of an application's backend, and Wyro would produce a complete TypeScript codebase, with authentication wired into every route and every write validated before it touched the database. 

To prove the compiler's internal model was real, Dominic made it run in reverse. Wyro learned to read an existing codebase and rebuild its architecture from the code: every route, every table, and the path between them. That reverse direction turned out to be the real product. AI tools could already generate a backend in seconds. Nothing could reliably tell you what that backend did with your data. 

In August 2026, Dominic rebuilt Wyro's entire positioning around that insight. The new homepage said it in eight words: "Generating a backend is easy. Checking one isn't." 

How Wyro Works

At its core, Wyro asks one question of every backend it reads: can a request reach your data without passing authentication first? Around that question, it flags routes with no visible input validation or rate limiting, and database security policies that leave a table open to anyone. It reads TypeScript, JavaScript and Python, from Express and Next.js to FastAPI, Supabase and SAP's Cloud Application Programming model. 

Three rules shape everything it does: 

1. Read the Shape, Not the Lines  - Instead of re-reading every line an AI wrote, Wyro maps the architecture: which routes exist, which tables they touch, and what stands between the two. A missing authentication check is easy to overlook in a 400-line change. On a map, it is the one path with nothing standing in front of it.

2. Same Code, Same Answer  - Wyro uses no AI model to check AI-written code. Its rules are deterministic, so the same code always gets the same answer, and a check costs almost nothing to run, which is why checking public code is free. "You can't fix unreviewed AI output by adding more AI output," Dominic says. "A checker that guesses is just one more thing nobody has reviewed."

3. Never a Confident Empty Answer  - When Wyro cannot read a codebase, it says so, instead of showing a reassuring green result it has not earned. In a build pipeline, it records the problems that already exist as a baseline and fails only on new ones, so a team can switch it on for a years-old codebase on day one without drowning in old warnings.

Together, these rules make Wyro behave less like a reviewer with opinions and more like a compiler. "Nobody loves the TypeScript compiler," Dominic says. "Everybody runs it. That's what we want Wyro to be for code that machines write." 

The Numbers Everyone Quotes, and the Ones They Skip

The AI coding conversation runs on a handful of well-worn statistics, and Dominic has a habit of reading past the headline. The most famous is GitHub's 2022 experiment, in which developers using Copilot finished a programming task 55 percent faster. It still turns up in keynotes everywhere. Far less quoted is a randomised trial published in July 2025 by the research group METR, in which experienced open-source developers took 19 percent longer to complete real tasks with AI tools, while believing they had been about 20 percent faster. 

Trust is moving the same way. In Stack Overflow's 2025 Developer Survey, more developers said they actively distrust the accuracy of AI tools (46 percent) than said they trust it (33 percent). Veracode's 2025 GenAI Code Security Report found that AI models introduced a vulnerability from the OWASP Top 10 in 45 percent of its test cases. And at the top of that OWASP list, in both its 2021 and 2025 editions, sits Broken Access Control: software that lets people reach data they should never be able to reach. That is exactly the gap Wyro maps. 

Then there is perhaps the most worshipped number in all of software: the claim, credited to the "IBM Systems Sciences Institute", that a bug costs 100 times more to fix in production than at the design stage. It has decorated slide decks for decades. When researchers went looking for the study behind it, they found course notes from an internal IBM training programme, and no data. The direction is probably right. The number has never been shown. "Our industry repeats a lot of numbers nobody has checked," Dominic says. "I didn't want to build another one." 

A Checker That Checks Itself

That instinct shows in how Wyro reports on itself. In September 2026, it ran its check over 100 popular open-source backends, covering 3,542 routes and 1,009 database tables. Twenty-one had at least one route that reached data without authentication. Rather than announce that 21 percent of backends were insecure, Wyro reviewed every unauthenticated write and published the honest version: many were public on purpose, some were the checker's own blind spots, and a few looked like real gaps. Every bug the study exposed in Wyro's own parser was fixed before a single number went out. 

The same discipline runs through its testing. Wyro measures itself against a labelled benchmark of more than 200 AI-built repositories, in which every finding is marked as a real problem, a deliberate design choice or a misreading. In a single round of work this October, misreadings fell from 260 to 13, and all 100 real problems in the set were still caught. 

Open-source maintainers have noticed. When the maintainer of invoicerr, an open-source invoicing application with more than 700 stars on GitHub, reviewed Wyro's 65 findings on the project and showed they were all false alarms, Dominic traced them to three parser bugs and fixed them the next day. The day after that, invoicerr committed Wyro's configuration to its repository, with every rule switched on, and pointed to the check from its README. 

"A checker that cries wolf gets switched off within a week," Dominic says. "So every false alarm is a bug, and we treat it like one." 

Built for the Way Software Is Made Now

Wyro works wherever the code is. Any public GitHub repository can be checked at wyro.in/scan, with no account. Developers can also run it from the command line through npm, add it as a check on every GitHub pull request, drop in a ZIP of an app exported from AI builders such as v0, Lovable and Bolt, or plug it into AI coding agents like Claude Code, Cursor and Codex, so the agent checks its own work before it says the job is done. 

Checking public repositories, the command-line tool, the agent integration, the browser extension and the GitHub Action are all free. Paid plans add more projects and collaborators, and a central policy that a company's repositories cannot quietly weaken. 

Why It Matters for India

The timing matters for India in particular. GitHub's Octoverse 2025 report projects that India will overtake the United States as the largest developer community on GitHub by 2030, with more than 57 million developers. Many of them will write their first production code with an AI assistant beside them. At the same time, IBM's 2025 Cost of a Data Breach report put the average breach in India at ₹22 crore, the highest it has ever recorded. 

"India is on track to have more developers than any other country, and a lot of them will ship code an AI wrote," Dominic says. "The question isn't whether to use AI. It's whether anything checks what it built before your users find out." 

Software, as Marc Andreessen famously wrote in 2011, is eating the world. Fifteen years later, AI is writing much of the software that does the eating. Wyro's bet is that the most valuable tool in that world will not be the one that writes the most code. It will be the one that tells you, in seconds and with the same answer every time, what that code actually does with your data. 

"Generating code is easy now," Dominic says. "Checking it isn't. That's the part we're building."