AI Writes the Code. Who Checks It? How 18-Year-Old Dominic Paul Built Wyro to Answer the Question the AI Boom Skipped
In October 2024, Sundar Pichai told investors that more than a quarter of all new code at Google was being written by AI. The figure quickly became one of the most widely repeated statistics in technology. By April 2026, Google said that number had climbed to 75 percent.
Everyone quotes that statistic. Far fewer people ask the question that naturally follows: if machines are writing three-quarters of the code, who is reading it?
In Bengaluru, 18-year-old founder Dominic Paul decided that question was worth building a company around. His answer is Wyro, a tool designed to examine a software application’s backend and assess its architecture, particularly the mechanisms that determine who can access sensitive data.
The Arithmetic Nobody Wanted to Do
The excitement surrounding AI-powered coding is easy to understand. In February 2025, Andrej Karpathy, a founding member of OpenAI and former head of AI at Tesla, coined the term “vibe coding” to describe building software by prompting AI and paying relatively little attention to the underlying code.
By November, Collins Dictionary had named it its Word of the Year. A month after Karpathy’s post, Y Combinator revealed that a quarter of the startups in its Winter 2025 batch estimated that more than 95 percent of their code was being written by AI.
Dominic looked at the same numbers and saw a different story.
“Everyone celebrates how fast AI writes code,” Dominic says. “But human review didn’t get any faster. If machines keep writing more and people can still only read the same amount, the share of code that nobody has read goes up every single month. That isn’t an opinion. It’s arithmetic.”
For nearly three decades, open-source software has drawn inspiration from Linus’s Law, Eric S. Raymond’s famous observation that “given enough eyeballs, all bugs are shallow.”
It is one of software development’s most enduring ideas. However, it quietly assumes that enough people will always be available to examine the code. When code arrives faster than humans can review it, that assumption is among the first to break.
The Turning Point That Changed Everything
Wyro did not begin as a code checker. Dominic wrote its first line of code in March 2026 while studying in Class 12 at St. Joseph’s Pre-University College in Bengaluru. He has built every part of the product himself.
The initial version was a backend compiler. Developers could draw or describe an application’s backend architecture, and Wyro would generate a complete TypeScript codebase, with authentication integrated into every route and every write validated before reaching the database.
To demonstrate that its internal model genuinely understood application architecture, Dominic made Wyro work in reverse. The tool learned to examine an existing codebase and reconstruct its architecture from the code, identifying every route, every database table, and the connections between them.
That reverse-engineering capability revealed the real opportunity.
AI tools could already generate a backend in seconds. What remained difficult was determining what that backend actually did with a user’s data.
In August 2026, Dominic rebuilt Wyro’s entire positioning around that insight. The new homepage communicated the idea in eight words:
“Generating a backend is easy. Checking one isn’t.”
How Wyro Works
At its core, Wyro asks one critical question of every backend it examines: can a request reach sensitive data without passing authentication first?
Beyond that, it flags routes without visible input validation or rate limiting, as well as database security policies that may leave tables accessible to unauthorised users.
The tool supports TypeScript, JavaScript, and Python, working across technologies such as Express, Next.js, FastAPI, Supabase, and SAP’s Cloud Application Programming model.
Three principles shape how Wyro operates.
- Read the Shape, Not the Lines
Rather than requiring developers to reread every line of AI-generated code, Wyro maps the application’s architecture. It identifies the routes that exist, the database tables they access, and the safeguards between them.
A missing authentication check can be easy to overlook in a 400-line code change. On an architectural map, however, it becomes much easier to identify a path with no protection.
- Same Code, Same Answer
Wyro does not use an AI model to review AI-generated code. Instead, it relies on deterministic rules, ensuring that the same code produces the same result every time.
This approach also keeps the cost of running a check extremely low, enabling Wyro to offer free scanning for public code.
“You can’t fix unreviewed AI output by adding more AI output,” Dominic says. “A checker that guesses is just one more thing nobody has reviewed.”
- Never a Confident Empty Answer
When Wyro cannot properly read a codebase, it reports the limitation instead of displaying a reassuring green result that it cannot justify.
Within a build pipeline, it records existing problems as a baseline and fails only when new issues appear. This allows teams to introduce Wyro into an older codebase without immediately being overwhelmed by years of accumulated warnings.
Together, these principles make Wyro behave less like a reviewer offering subjective opinions and more like a compiler delivering consistent results.
“Nobody loves the TypeScript compiler,” Dominic says. “Everybody runs it. That’s what we want Wyro to be for code that machines write.”
The Numbers Everyone Quotes, and the Ones They Skip
The AI coding debate often revolves around a handful of familiar statistics. Dominic, however, tends to look beyond the headline figures.
One of the most frequently cited examples comes from GitHub’s 2022 Copilot experiment, in which developers using the AI coding assistant completed a programming task 55 percent faster. The result continues to appear in technology presentations and discussions.
Less widely discussed is a randomised trial published in July 2025 by the research group METR. In that study, experienced open-source developers took 19 percent longer to complete real-world tasks when using AI tools, even though they believed they had worked approximately 20 percent faster.
Developer trust presents a similar challenge. Stack Overflow’s 2025 Developer Survey found that more developers actively distrusted the accuracy of AI tools, at 46 percent, than trusted them, at 33 percent.
Veracode’s 2025 GenAI Code Security Report found that AI models introduced a vulnerability associated with the OWASP Top 10 in 45 percent of its test cases.
At the top of the OWASP lists for both 2021 and 2025 is Broken Access Control, a category covering software that allows people to access information or functionality they should not be permitted to reach.
That is precisely the kind of architectural gap Wyro is designed to identify.
Then there is one of the most frequently repeated claims in software engineering: the assertion, attributed to the IBM Systems Sciences Institute, that a bug costs 100 times more to fix in production than during the design stage.
The statistic has appeared in presentation decks and industry discussions for decades. Yet investigations into its origins have pointed towards internal IBM training materials rather than a clearly documented empirical study. The general principle that late-stage defects can be more expensive to fix is widely accepted, but the precise 100-times figure lacks the evidentiary foundation many people assume it has.
“Our industry repeats a lot of numbers nobody has checked,” Dominic says. “I didn’t want to build another one.”
A Checker That Checks Itself
That commitment to evidence is reflected in how Wyro evaluates its own performance.
In September 2026, the tool scanned 100 popular open-source backends, covering 3,542 routes and 1,009 database tables. Twenty-one of those backends had at least one route that could reach data without authentication.
Rather than announce that 21 percent of the backends were insecure, Dominic reviewed every unauthenticated write. The resulting assessment was more nuanced: many routes were intentionally public, some findings exposed limitations in Wyro’s own analysis, and a smaller number appeared to represent genuine security gaps.
Every bug the exercise uncovered in Wyro’s parser was fixed before the results were published.
The same discipline guides the product’s testing process. Wyro measures its performance against a labelled benchmark of more than 200 AI-built repositories. Each finding is classified as a genuine problem, an intentional design decision, or a misinterpretation by the checker.
During a single round of work in October, the number of misinterpretations fell from 260 to 13, while all 100 genuine problems in the test set continued to be detected.
Open-source maintainers have also begun evaluating the tool.
When the maintainer of invoicerr, an open-source invoicing application with more than 700 GitHub stars, reviewed Wyro’s 65 findings on the project and determined that all were false positives, Dominic traced the results to three parser bugs and fixed them the following day.
The day after that, invoicerr committed Wyro’s configuration to its repository with every rule enabled and referenced the check in its README.
“A checker that cries wolf gets switched off within a week,” Dominic says. “So every false alarm is a bug, and we treat it like one.”
Built for the Way Software Is Made Now
Wyro is designed to fit into existing development workflows rather than require teams to adopt an entirely new process.
Developers can scan public GitHub repositories through wyro.in/scan without creating an account. They can also run the tool from the command line using npm, add it to GitHub pull-request checks, or upload a ZIP file containing an application exported from AI development platforms such as v0, Lovable, and Bolt.
Wyro can also integrate with AI coding agents, including Claude Code, Cursor, and Codex, allowing the agent to check its work before reporting a task as complete.
The command-line tool, agent integration, browser extension, GitHub Action, and public repository scanning are all free. Paid plans offer additional projects and collaborators, along with centralised policies designed to prevent individual repositories from quietly weakening a company’s security requirements.
The underlying idea is straightforward: code checking should happen as naturally as code generation, ideally before a change reaches production.
Why It Matters for India
The timing is particularly significant for India.
GitHub’s Octoverse 2025 report projects that India could overtake the United States as the platform’s largest developer community by 2030, with more than 57 million developers. Many of these developers will begin writing production software with AI assistants alongside them.
At the same time, IBM’s 2025 Cost of a Data Breach report placed the average cost of a data breach in India at ₹22 crore, its highest recorded level.
Together, these trends highlight an important challenge. As AI makes software development more accessible and accelerates the creation of new applications, the systems responsible for protecting data must keep pace.
“India is on track to have more developers than any other country, and a lot of them will ship code an AI wrote,” Dominic says. “The question isn’t whether to use AI. It’s whether anything checks what it built before your users find out.”
Software, as Marc Andreessen famously wrote in 2011, is eating the world. Fifteen years later, AI is writing much of the software driving that transformation.
Wyro’s bet is that the most valuable tool in this new landscape will not necessarily be the one that generates the most code. It will be the one that can explain, within seconds and consistently, what that code actually does with your data.
“Generating code is easy now,” Dominic says. “Checking it isn’t. That’s the part we’re building.”
