H33 Launches HICS for Free: The First Trust-less Software Scoring Tool with Post Quantum Cryptographic Proof

Free cryptographically verified code quality scoring for software procurement. The best software wins. Not the best friend. Not the best pitch.

RIVERVIEW, FL, UNITED STATES, March 31, 2026 /EINPresswire.com/ -- H33.ai, Inc. today announced HICS (H33 Independent Code Scoring), a free software quality scoring tool that produces cryptographically verifiable results using STARK zero-knowledge proofs and Dilithium post-quantum digital signatures. HICS is available immediately at no cost, with no account required, and no source code ever transmitted from the developer's machine.

HICS evaluates codebases across five weighted dimensions - Cryptographic Security, Vulnerability Surface, Data Handling and Privacy, Operational Resilience, and Code Health - producing a score from 0 to 100. The scoring formula is open source and publicly auditable. The implementation runs locally on the developer's machine.


FREE. UNLIMITED. NO ACCOUNT.

HICS is free for every developer on every codebase, forever:

brew install h33/tap/hics && hics scan .

No cloud upload. No account. No telemetry. The CLI makes zero network calls - no update checks, no error reporting, no analytics. This is a fundamental architectural choice, not a trial limitation.


WHY EXISTING TOOLS AREN'T ENOUGH

The software security ecosystem already includes static analysis (SonarQube, Semgrep, CodeQL), software composition analysis for dependencies (Snyk, Mend, Dependabot), SBOM generation (CycloneDX, SPDX), binary scanning (Black Duck), formal verification tools, and paid third-party code audits. HICS does not replace these tools. It solves a problem none of them address: provable, tamper-proof, third-party-verifiable scoring.

Static analysis tools (SonarQube, Semgrep) produce reports. Reports are files. Files can be edited, redacted, or fabricated. A vendor can get 47 critical findings, fix the report to show zero, and send it to a buyer. The buyer has no way to verify the report wasn't altered. HICS scores are sealed with a STARK proof and a Dilithium signature. Altering a single finding invalidates the proof. Mathematically.

SCA and SBOM tools (Snyk, CycloneDX) analyze dependencies, not code quality. Paid third-party audits (NCC Group, Trail of Bits) are $50,000-$500,000 per engagement and produce a PDF - also just a file. Formal verification (Kani, Coq) proves specific properties about specific functions but doesn't produce an overall quality score.

No existing tool produces output that a third party can independently verify without trusting the vendor. That is what HICS does.



THE ATTESTATION LAYER

For enterprises requiring verifiable proof, HICS generates a .h33 certificate containing four cryptographic artifacts:

- SHA3-256 Merkle Root: Commits the exact codebase version without revealing file contents.
- STARK Proof: Proves the scoring algorithm executed correctly. Zero-knowledge. No trusted setup. Quantum-resistant.
- Dilithium ML-DSA-65 Signature (NIST FIPS 204): Post-quantum signature that cannot be forged by classical or quantum computers.
- Proof ID: A permanent identifier that anyone can verify at h33.ai/verify.

The free scan gives developers their score. The paid attestation makes it a mathematical fact.

If you're evaluating software from any vendor, ask one question: "What's your HICS score?" If they have one, verify it at h33.ai/verify. If they don't, ask why. If they won't run it, that tells you everything you need to know. The tool is free. The scan is local. There is no reason not to run it-unless already know what it will find.


H33 SCORED ITSELF FIRST

Before launching HICS, H33 ran it against its own production codebase - 478 files, 294,200 lines of Rust. The score: 70 out of 100. Grade C. H33 published the findings, the deductions, and the remediation plan in a public blog post titled "We Scored a C."

Over the following 24 hours, H33 fixed every finding and hit 100. The algorithm was not modified. The code was. Both scores remain publicly accessible.


HICS-PQ: POST-QUANTUM LIBRARY ATTESTATIONS

Every release, automatically attested. HICS-PQ is the first per-library post-quantum attestation program with STARK proof and automated release timestamps. Each H33 cryptographic library - Dilithium, Kyber, FALCON, SPHINCS+, and three FHE engines - carries a publicly verifiable attestation at h33.ai/pq that updates every time the code ships.

HICS-PQ evaluates four dimensions: Correctness (NIST Known Answer Test vectors), Security (constant-time execution, side-channel resistance), Performance (latency benchmarks), and Standards Compliance (FIPS 203/204/206). Anyone can verify. Anyone can check the timestamp. The math doesn't age.


THE VERIFICATION BADGE

Vendors who earn a HICS attestation receive an embeddable verification badge - a live cryptographic check, not a static image. Clicking the badge runs five real-time checks: Proof ID existence, STARK proof validity, Dilithium signature validation, Merkle root integrity, and certificate freshness. H33 is the first company to display the badge, linking to its verified 100/100 at h33.ai/verify.


OPEN FORMULA, PROPRIETARY IMPLEMENTATION

The scoring formula - weights, thresholds, finding types, confidence methodology - is published openly for public audit. The implementation is proprietary. The methodology is transparent. The technology is licensed.


KEY FACTS

- Price: Free CLI scan, unlimited, no account, no network calls. Forever.
- Paid tier: STARK-proven, Dilithium-signed attestation certificates.
- Proof: STARK (SHA3-256, quantum-resistant). Signature: Dilithium ML-DSA-65 (FIPS 204).
- Source code transmission: None. The CLI makes zero network calls.
- H33's score: 100/100, publicly verified at h33.ai/verify.
- Languages: Rust, Python, JavaScript, TypeScript (AST); all languages (pattern).


AVAILABILITY

HICS is available immediately at no cost. Run your first HICS scan today: h33.ai/hics. Enterprise attestation inquiries: sales@h33.ai.

The full story - from 70 to 100 - is published at h33.ai/blog/from-c-to-100.


ABOUT H33

H33 is a post-quantum Privacy-as-a-Service platform combining FHE, STARK zero-knowledge proofs, and NIST post-quantum signatures in a single API call. 2.17 million authentications per second. 38.5 microseconds per auth. Zero data exposure. 134 patent claims pending. SOC 2 Type II audit in progress. Built entirely in Rust.

h33.ai | media@h33.ai


MEDIA CONTACT

H33.ai, Inc.
media@h33.ai
h33.ai

Eric D Beans
H33.ai, Inc.
+1 813-464-0945
email us here
Visit us on social media:
LinkedIn
YouTube
X

Legal Disclaimer:

EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.