At first
It ships
Prompts turn into features faster than any team could type them.
Services - Your AI-built app works. That is not the same as ready.
Lovable, Bolt, v0, Cursor, and Claude Code get you to a working product in days. What they do not give you is an app that survives its first real users, its first attacker, or its first developer handover. We read the code line by line and tell you exactly where it stands, in writing, in 48 hours.
The problem - It demos beautifully. Production is a different test.
AI coding tools optimize for the screen in front of you. Everything that does not appear on that screen is negotiable to them, and security lives almost entirely off-screen.
What the demo shows
OKA sign-in page that looks exactly right. Everything the demo touches is on this screen, so the demo never fails.
What sits behind it
3 Critical- Critical
The API behind it
Never checks who is calling. Swap the user id, read someone else’s account.
- Critical
The database under that
Row-level security off. Anyone holding the public key can read every row.
- Critical
The bundle you ship
The payment secret sits in the JavaScript every visitor downloads.
None of it breaks the demo. All of it breaks the week you launch.
Then
It drifts
No tests, no review. Each new prompt quietly undoes something that worked yesterday.
Eventually
It stalls
The code outgrows anyone’s understanding of it, and the developer you hire quotes a rewrite.
An audit turns that uncertainty into a list: what is wrong, where it is, and what it would cost an attacker to use it.
- of AI-generated code samples introduced an OWASP Top 10 flaw (Veracode, 2025)
- 45%
- From repository access to a written, ranked report
- 48 h
- Dimensions graded, from secrets handling to cost exposure
- 8
What we find - The same six failures, in almost every AI-built codebase
The generator changes the shape of the code, not the mistakes. These are the findings that come back again and again, whichever tool produced the app.
- Secrets in the client bundle. API keys, service-role tokens, and webhook secrets placed in a file that ships to the browser. Anyone can read them from view-source, and rotating them is the easy half of the fix.
- Authorization that lives in the interface. The button is hidden, so the feature looks protected. The endpoint behind it still answers to anyone who calls it directly with a different user id.
- Databases open by default. Supabase and Firebase projects with row-level security switched off, or written permissively enough that one customer can read every other customer’s records.
- Input that nobody validates. Request bodies go straight into a query, a file path, or a template, with nothing checking their shape, their size, or whether they belong to the caller at all.
- Zero test coverage. Nothing catches a regression, so features disappear silently and no one can say which prompt removed them. Every change becomes a gamble on the parts you forgot to click.
- Costs with no ceiling. No rate limits and no quotas on endpoints that call an LLM or a metered third-party API. One scraper, or one bad loop, turns into a five-figure invoice.
Coverage - Whatever it is written in, we can read it
Prompted codebases rarely land on one stack. A Next.js front end on Supabase, an Angular panel over a Java service, a Swift app calling Python. The languages change what the findings look like, not what they are.
Frontend
React
Next.js
Vue
Nuxt
Angular
Svelte
Astro
TypeScript
Tailwind CSS
Backend and APIs
Node.js
NestJS
Express
Python
Django
FastAPI
Java
Spring
Go
.NET
PHP
Laravel
Ruby
GraphQL
Mobile
Swift
Kotlin
Flutter- React Native
Expo
Data and infrastructure
PostgreSQL
MySQL
MongoDB
Redis
Supabase
Firebase
Prisma
Docker
AWS
Vercel
Not on the list? Ask on the call. The eight dimensions we grade are language-agnostic, and we tell you before you pay if your stack is one we would rather not take on.
The deliverable - One report, ranked by what will hurt you first
You get a written document, not a scanner dump. Every finding names the file, explains the concrete failure it enables, and carries a severity we are prepared to defend on a call.
Example report card
4 Critical3 Watch1 OK
- Secrets & configuration
- Service-role key bundled into the client
- Critical
- Auth & access control
- Endpoints trust a client-supplied user id
- Critical
- Data & row-level security
- RLS disabled on 4 of 7 tables
- Critical
- Tests & CI
- No test suite, no pipeline
- Critical
- Input validation
- Write paths accept unvalidated bodies
- Watch
- Architecture
- Business logic inlined in components
- Watch
- Dependencies
- 11 packages unpinned, 3 unmaintained
- Watch
- Performance & cost
- Holds under expected load, rate limits absent
- OK
Illustration of the report format. The findings above are representative of what we see in AI-generated codebases, not results from a client engagement.
How it works - From first call to a report you can act on
No procurement cycle and no discovery phase. Four steps, most of them ours.
Book the call.
Thirty minutes, free. You show us the app, we ask what it is meant to do and who it is meant to serve, and we quote the audit on the spot.
Give us read access.
Your repository, or the export from your builder, plus read-only access to your backend project. NDA first if you want one. We never need production credentials.
Get the report in 48 hours.
Eight dimensions graded. Every finding names a file, the concrete failure it enables, and a severity. Walked through live if you want it.
Choose what happens next.
Take the report to your own developer, or pick one of the three paths below. The recommendation is in the report either way, and you are under no obligation.
After the audit - Three ways forward, and we tell you which one you need
The report ends with a recommendation. Sometimes it is a two-day fix. Sometimes the honest answer is that the foundations have to be rebuilt, and we say so plainly rather than selling you the largest option available.
Targeted fix
Days, not weeks
The critical findings, closed. Secrets rotated and moved server-side, access control enforced on the API rather than in the interface, row-level security written properly. Your stack stays exactly as it is.
Hardening sprint
1 week
Everything in the targeted fix, plus schema validation on every write path, a test suite covering the flows that make you money, a pipeline that blocks a breaking change, and development separated from production.
Rebuild and takeover
2+ weeks
For when the foundations cannot be patched. We keep your screens and your UX, the part vibe coding gets right, and rebuild what sits underneath: authentication, data model, API layer, security, tests, and deployment.
Independence - The point is that you stop depending on anyone
An audit that leaves you reliant on the people who wrote it has failed. Whatever path you take afterwards, you end up owning the result.
- The report, regardless. Whether you continue with us or not, the written audit is yours to keep and to hand to any developer you hire next.
- Code you own. In your Git, under your license, structured so that an engineer who has never seen it can find their way around in an afternoon.
- No new lock-in. Your Lovable or Bolt subscription becomes optional rather than replaced by a dependency on us. Keep using AI tools if they suit you.
- Tests and a pipeline. Coverage on the flows that matter and continuous integration that fails loudly, before your users are the ones who notice.
Vibe code audit: frequently asked questions
What founders ask us before booking an audit. If your question is not here, put it in the form and we will answer it on the call.
A line-by-line human review of the application an AI tool built for you. We grade eight dimensions, from secrets handling and access control to tests and cost exposure, and return a written report that names the file behind every finding, explains what an attacker or a bad input could actually do with it, and ranks everything by what will hurt you first. It is a code review by engineers, not an automated scanner report.
No. This service covers application codebases: Next.js, React, Node, Python, Supabase, Firebase, and the infrastructure around them. Smart contract review is a separate engagement with a different method and a different price. If your project needs both, tell us on the call and we will scope them together.
Lovable, Bolt.new, v0, Replit, Base44, Cursor, Claude Code, Windsurf, and GitHub Copilot, plus anything else that generated code you did not write yourself. The tool changes the shape of the codebase, not the failure patterns, so the audit method is the same across all of them.
On the frontend: React, Next.js, Vue, Nuxt, Angular, Svelte, Astro, TypeScript, and Tailwind CSS. On the backend: Node.js, NestJS, Express, Python with Django or FastAPI, Java with Spring, Go, .NET, PHP with Laravel, Ruby, and GraphQL APIs. On mobile: Swift, Kotlin, Flutter, React Native, and Expo. Around them: PostgreSQL, MySQL, MongoDB, Redis, Supabase, Firebase, Prisma, Docker, AWS, and Vercel. The eight dimensions we grade are language-agnostic, so if your stack is not on that list, ask on the call.
The written report lands 48 hours after we get read access, for a typical single-product codebase. If your project is large enough that 48 hours would mean a shallow review, we tell you the real timeline on the assessment call rather than after you have paid.
Read access to the repository, or the export from your builder, plus the URL of the deployed app and read-only access to your backend project if you use one such as Supabase or Firebase. Read-only is enough. We never need production credentials or customer data.
Yes. We sign an NDA before looking at anything if you want one, we work from read-only access, and we do not retain a copy of your codebase once the engagement ends. The report itself is yours and we do not publish it or reference your project without written permission.
Both. The report is a standalone deliverable you can hand to any developer, including your own. If you would rather we close the findings, the report ends with a recommended path, priced separately: a targeted fix on the critical items, a hardening sprint, or a full rebuild of the foundations.
Usually not. The screens, the design, and the flows are the part vibe coding actually gets right, and they are the reason you got to a working product quickly. A rebuild keeps them and replaces what sits underneath: authentication, the data model, the API layer, security, tests, and deployment.
Then that is what the report says, and you launch with a written second opinion instead of a hunch. We are not incentivized to manufacture findings: the audit is priced as its own deliverable, and the recommendation at the end is as often a two-day fix as it is a rebuild.
The assessment call is free and takes 30 minutes. The audit is a fixed price quoted on that call, once we know the size of the codebase and the stack involved. Any follow-on work is quoted from the report, so you see the findings before you commit to fixing them.