A Lifetime License for a Lifetime Threat: Rafter Is on AppSumo
Written by the Rafter Team
Rafter is on AppSumo as a lifetime deal right now. Limited time. Search "Rafter" on AppSumo, or head to appsumo.com/s/1yvki7f while the window's open. If you've been putting off the "real PR-time security scanner" line item, this is the cheapest version of yes you'll see this year.
A lifetime license for a continuous control is not a marketing trick. PR-time code-security scanning is the shape of defense that runs as long as you keep coding. The pricing model that matches "runs forever" is "you pay for it once." That is the argument this post makes. The deal closes when AppSumo says it does.
The rest of this post is the structural argument for why the lifetime framing fits this category. If you already trust the framing, skip to the deal and grab it. If you want the reasoning, read on.
What changed two weeks ago
CNBC ran a piece on May 13 quoting Palo Alto Networks CTO Lee Klarich on a "narrow three-to-five-month window for organizations to outpace the adversary before AI-driven exploits start to become the new norm." That timeline framing is the headline. The line that matters more is the one a few paragraphs later: "The big question just a few weeks ago was: 'Are we overstating the model capabilities?' With more testing, I can confidently say we weren't. In fact, these models are likely even better at finding vulnerabilities than we initially realized."
That is a vendor CTO admitting the security industry's calibration of model capability was wrong, in the direction that favors attackers, by enough that the public estimate is being revised mid-sentence. We covered the Mythos calibration shift in more depth — the short version is that vulnerability discovery is now cheap on the attacker side, by a margin that surprised the vendors who are supposed to be calibrated for exactly this.
The defenders not on Anthropic's early-access list — which is to say, almost everyone reading this — are operating with the assumption set they had a year ago against an attacker capability that has materially improved. That gap is the gap your security program has to close.
Why "continuous" beats "periodic" and "lifetime" matches "continuous"
If you accept that vulnerability discovery is now cheap on the attacker side, the defender posture that scales is one specific thing: a code-security review that runs on every PR, against the bug classes an AI-augmented attacker would catch first, for as long as you keep writing code.
Periodic controls do not scale to this shape. Quarterly audits run four times a year. Annual pen tests run once. The attacker's discovery loop runs continuously, at machine speed, against every commit you've ever pushed to a public repo. The math is unkind to periodic controls — a bug introduced in a sprint and merged into main is, from the attacker's perspective, a publication event. The only defender variable left is how long the bug sits in main before you notice it. Continuous gates close the window. Periodic gates do not.
The attacker's calendar post argues the same thing from the campaign-timing angle: every periodic control compresses defender attention into a calendar trough that operators have learned to time their campaigns against. Continuous controls distribute across the year. Same conclusion, different lens.
The pricing model that matches a continuous control has two shapes. Subscription, where you pay for the control as long as the control runs. Lifetime, where you pay once for "the control runs for as long as you have a use for it." Both work. Lifetime closes the renewal-cycle conversation permanently, which for a small team or solo founder is its own benefit. AppSumo deals exist for exactly this shape of buyer.
What Rafter runs on every PR
Concretely, when you point Rafter at a diff:
SAST. Static analysis for the bug classes that scale when attackers have AI — eval() on untrusted input, filter injection, path traversal, insecure deserialization, the classical OWASP Top 10 classes that AI agent frameworks are still shipping in 2026.
SCA. Dependency analysis. Known-vulnerable versions, suspicious postinstall hooks, unpinned packages that admit silent version drift. The same hygiene that catches the wallet-stealer floor and everything stacked on top of it.
Secrets check. Credential detection across the diff. rafter secrets . runs locally with no signup, so you can audit a repo offline before deciding whether to do anything else.
Agentic deep-dives (--mode plus). For code paths where pattern matching is not enough — bugs in the interaction between two well-written components rather than in either one alone. Slower, higher-fidelity, runs on the changes that look interesting.
Rafter is opinionated about running at PR time. The reason is the PR-as-disclosure framing: every change merged to main is, from the attacker's perspective, a publication event. The earlier in your cycle the review fires, the smaller the window between "you wrote a bug" and "an attacker is reading your code."
What Rafter is not
Honest bullets, because everything else costs trust later.
Rafter does not stop a determined nation-state adversary. Nothing does. If you're a primary target of a well-funded campaign, you need a security program, not a tool. Rafter is one line item in that program.
Rafter does not replace adversary simulation, threat modeling, or a real pen test. Those exercises probe properties a code scanner cannot — operational response, organizational resilience, the gap between policy and practice. If your program currently substitutes a quarterly pen test for code-time security review, the gap to fill is the code-time review, not the pen test.
Rafter does not replace a competent security engineer. It puts the OWASP-Top-10-shaped questions on every PR so the engineer's attention can go to the questions a scanner cannot answer. Hand a scanner the boring half so the human can run the interesting half.
Rafter does not eliminate prompt injection, jailbreaks, or model-side bugs. Those live in the AI runtime, not in your code. The AI security beyond prompt injection post is the longer argument for why the bug classes most AI-security incidents land on are classical AppSec classes, and why a scanner for those classes is where the budget actually moves the incident curve.
The deal
AppSumo is running Rafter as a lifetime deal. The window is limited. Two ways in:
- Search "Rafter" on AppSumo.
- Or hit appsumo.com/s/1yvki7f.
What you get is a license attached to your account, redeemed once, valid for as long as the account exists. The tier you pick at redemption maps to a scan-volume bucket appropriate to the rhythm of a small team, an indie founder, or a senior engineer running a side stack. If you outgrow the tier later, that's the kind of problem worth having.
The deal closes when AppSumo says it does. The continuous-control argument above is durable; the price is not.
The window inside the window
Klarich's framing in the CNBC piece is "you have three to five months." The corrected framing, given the same article's calibration admission, is the window for shipped code closed a while ago and you didn't get the email; the only window you actually control is the one between writing code and shipping it.
That window is your patch cycle. AI did not shorten it. AI just made the attacker side of it cheap. The defensive move is to run a control inside that window that operates at the same speed as the attacker's tools, on every change, for as long as you keep coding.
AppSumo's lifetime deal lets you make the cost of that control a one-time line item and stop renegotiating it every year. The window — Klarich's or AppSumo's, your pick — closes when it closes.