AI writes most of the code now. The vibe coder says "connect to the database and return the user." They don't say "don't log the password." Loon's type system says it for them.
# No language prevents this today
logging.info(f"Login: user={username} password={password}")
# It ships. It logs passwords to Datadog.
# You find out from a security audit.// Loon catches it before it ships
do print("Login: " + username + " password=" + password);
error[E301]: cannot log Sensitive value
password: Sensitive<String>
logging Sensitive data is prohibitedSensitive<String> cannot be logged, serialized, or sent over the network. Not a lint warning. Not a runtime check. A compile error. The type system tracks sensitivity through every function call, every variable binding, every return value.
fn authenticate(password: Sensitive<String>) -> [IO] Bool {
do print(password);
// error[E301]: cannot log Sensitive value
}Every function declares what it does. [IO] means it touches the outside world. [Audit] means it writes audit logs. [Crypto] means it handles key material. The compiler verifies the entire call chain. A pure function cannot call an IO function — no exceptions, no escape hatches.
fn read_config(path: String) -> [IO] String {
do read_file(path)
}
fn validate(s: String) -> Bool {
do read_config("x");
// error: pure function cannot perform [IO]
}Every variant of a type must be handled. Forget a case and the compiler rejects it. This catches the bugs that AI code generators produce most often: the unhandled edge case, the missing error path, the None that becomes a null pointer dereference in production.
match result {
| Ok(value) -> use(value)
// error: non-exhaustive match
// missing: Err(e)
}Compiler errors are JSON. When an AI agent writes Loon code and the compiler rejects it, the agent gets a machine-readable error with the exact location, the violated rule, and a suggested fix. No regex parsing of error messages. The feedback loop is tight and deterministic.
{"error": "E301",
"message": "cannot log Sensitive value",
"location": {"line": 4, "col": 12},
"variable": "password",
"type": "Sensitive<String>"}Loon's compiler is built from 8,553 lines of x86-64 assembly. No C runtime. No LLVM. No borrowed toolchain. The trust chain starts at instructions you can read and verify. Every byte of the compiler is accounted for in this repository.
| Stage | What | How |
|---|---|---|
| Stage 0 | Hand-written assembly lexer | 1,198 lines of x86-64 asm |
| Stage 1 | Hand-written assembly compiler | 6,542 lines of x86-64 asm |
| Stage 2 | Loon compiler written in Loon | Self-hosting |
| Stage 3 | LLVM backend, WASM, Float, LSP | Cross-platform |
| Stage 4 | Privacy types, effect system | Complete |
Loon is free to use, read, modify, and distribute for individuals, small organizations, nonprofits, and educational institutions. The source is open. The compiler is yours.