At first
It ships
Prompts turn into features faster than any team could type them.
Services - Your AI-built app works. That is not the same as ready.
Lovable, Bolt, v0, Cursor, and Claude Code get you to a working product in days. What they do not give you is an app that survives its first real users, its first attacker, or its first developer handover. We read the code line by line and tell you exactly where it stands, in writing, in 48 hours.
The problem - It demos beautifully. Production is a different test.
AI coding tools optimize for the screen in front of you. Everything that does not appear on that screen is negotiable to them, and security lives almost entirely off-screen.
What the demo shows
OKA sign-in page that looks exactly right. Everything the demo touches is on this screen, so the demo never fails.
What sits behind it
3 Critical- Critical
The API behind it
Never checks who is calling. Swap the user id, read someone else’s account.
- Critical
The database under that
Row-level security off. Anyone holding the public key can read every row.
- Critical
The bundle you ship
The payment secret sits in the JavaScript every visitor downloads.
None of it breaks the demo. All of it breaks the week you launch.
Then
It drifts
No tests, no review. Each new prompt quietly undoes something that worked yesterday.
Eventually
It stalls
The code outgrows anyone’s understanding of it, and the developer you hire quotes a rewrite.
An audit turns that uncertainty into a list: what is wrong, where it is, and what it would cost an attacker to use it.
- of AI-generated code samples introduced an OWASP Top 10 flaw (Veracode, 2025)
- 45%
- From repository access to a written, ranked report
- 48 h
- Dimensions graded, from secrets handling to cost exposure
- 8
What we find - The same six failures, in almost every AI-built codebase
The generator changes the shape of the code, not the mistakes. These are the findings that come back again and again, whichever tool produced the app.
- Secrets in the client bundle. API keys, service-role tokens, and webhook secrets placed in a file that ships to the browser. Anyone can read them from view-source, and rotating them is the easy half of the fix.
- Authorization that lives in the interface. The button is hidden, so the feature looks protected. The endpoint behind it still answers to anyone who calls it directly with a different user id.
- Databases open by default. Supabase and Firebase projects with row-level security switched off, or written permissively enough that one customer can read every other customer's records.
- Input that nobody validates. Request bodies go straight into a query, a file path, or a template, with nothing checking their shape, their size, or whether they belong to the caller at all.
- Zero test coverage. Nothing catches a regression, so features disappear silently and no one can say which prompt removed them. Every change becomes a gamble on the parts you forgot to click.
- Costs with no ceiling. No rate limits and no quotas on endpoints that call an LLM or a metered third-party API. One scraper, or one bad loop, turns into a five-figure invoice.
Coverage - Whatever it is written in, we can read it
Prompted codebases rarely land on one stack. A Next.js front end on Supabase, an Angular panel over a Java service, a Swift app calling Python. The languages change what the findings look like, not what they are.
Frontend
React
Next.js
Vue
Nuxt
Angular
Svelte
Astro
TypeScript
Tailwind CSS
Backend and APIs
Node.js
NestJS
Express
Python
Django
FastAPI
Java
Spring
Go
.NET
PHP
Laravel
Ruby
GraphQL
Mobile
Swift
Kotlin
Flutter- React Native
Expo
Data and infrastructure
PostgreSQL
MySQL
MongoDB
Redis
Supabase
Firebase
Prisma
Docker
AWS
Vercel
Not on the list? Ask on the call. The eight dimensions we grade are language-agnostic, and we tell you before you pay if your stack is one we would rather not take on.
The deliverable - One report, ranked by what will hurt you first
You get a written document, not a scanner dump. Every finding names the file, explains the concrete failure it enables, and carries a severity we are prepared to defend on a call.
Example report card
4 Critical3 Watch1 OK
- Secrets & configuration
- Service-role key bundled into the client
- Auth & access control
- Endpoints trust a client-supplied user id
- Data & row-level security
- RLS disabled on 4 of 7 tables
- Tests & CI
- No test suite, no pipeline
- Input validation
- Write paths accept unvalidated bodies
- Architecture
- Business logic inlined in components
- Dependencies
- 11 packages unpinned, 3 unmaintained
- Performance & cost
- Holds under expected load, rate limits absent
Illustration of the report format. The findings above are representative of what we see in AI-generated codebases, not results from a client engagement.
How it works - From first call to a report you can act on
No procurement cycle and no discovery phase. Four steps, most of them ours.
Book the call.
Thirty minutes, free. You show us the app, we ask what it is meant to do and who it is meant to serve, and we quote the audit on the spot.
Give us read access.
Your repository, or the export from your builder, plus read-only access to your backend project. NDA first if you want one. We never need production credentials.
Get the report in 48 hours.
Eight dimensions graded. Every finding names a file, the concrete failure it enables, and a severity. Walked through live if you want it.
Choose what happens next.
Take the report to your own developer, or pick one of the three paths below. The recommendation is in the report either way, and you are under no obligation.
After the audit - Three ways forward, and we tell you which one you need
The report ends with a recommendation. Sometimes it is a two-day fix. Sometimes the honest answer is that the foundations have to be rebuilt, and we say so plainly rather than selling you the largest option available.
Targeted fix
Days, not weeks
The critical findings, closed. Secrets rotated and moved server-side, access control enforced on the API rather than in the interface, row-level security written properly. Your stack stays exactly as it is.
Hardening sprint
1 week
Everything in the targeted fix, plus schema validation on every write path, a test suite covering the flows that make you money, a pipeline that blocks a breaking change, and development separated from production.
Rebuild and takeover
2+ weeks
For when the foundations cannot be patched. We keep your screens and your UX, the part vibe coding gets right, and rebuild what sits underneath: authentication, data model, API layer, security, tests, and deployment.
Independence - The point is that you stop depending on anyone
An audit that leaves you reliant on the people who wrote it has failed. Whatever path you take afterwards, you end up owning the result.
- The report, regardless. Whether you continue with us or not, the written audit is yours to keep and to hand to any developer you hire next.
- Code you own. In your Git, under your license, structured so that an engineer who has never seen it can find their way around in an afternoon.
- No new lock-in. Your Lovable or Bolt subscription becomes optional rather than replaced by a dependency on us. Keep using AI tools if they suit you.
- Tests and a pipeline. Coverage on the flows that matter and continuous integration that fails loudly, before your users are the ones who notice.
Vibe code audit: frequently asked questions
What founders ask us before booking an audit. If your question is not here, put it in the form and we will answer it on the call.