I kept finding the same security bugs in AI-generated code. Copilot autocompletes SQL injection. Cursor pastes keys in files. Default patterns, not edge cases. Existing tools don't serve solo devs. Snyk is $25+/mo. Semgrep needs custom rules. Critik scans with regex/AST, then AI reviews each finding with full file context. It knows eval() in a test isn't eval(user_input) in a handler. pip install critik && critik scan . Open source. Free tier. No config.