Audit your vibe-coded app before real users find the problems

Tests the deployed application from outside, the way any visitor reaches it: transport security, security response headers, and what the running service discloses about itself. It needs nothing but the address, and what it observes it observes against the running system. Its limit is reach rather than strength: a URL can never establish authorisation, data-layer or backup posture, and those controls stay uncovered.

Reads the source: where secrets live, whether authorisation is enforced on the server or only in the interface, whether data access is injection safe, and which dependencies carry known critical vulnerabilities. Findings cite the file they came from, so a result is checkable rather than asserted.

Builds and runs the application in an isolated environment and probes the running system. This is the layer that answers questions reading code cannot: whether the deployed configuration actually refuses an unauthorised request, and whether error responses leak internals under real conditions.

Authorisation that lives in the interface

The admin button renders only for admins and the edit form appears only for the owner, so the application looks correct. Requests do not come from the interface. If ownership is not checked on the server, a direct request reaches another account's record, which is the most exploited weakness in the OWASP API list.

Database rules that were never switched on

A generated backend frequently ships with table-level rules disabled or with a policy that only asks whether someone is logged in. During development, when you are the only user, the data looks correctly scoped. In production it is readable by anyone holding the public key.

Privileged keys inside the browser bundle

Some keys belong in client code and are safe there. A key that bypasses your database rules is not one of them, and once it ships in a bundle every visitor has downloaded it. Removing it later does not undo the exposure.

Dependencies nobody has read

A project can acquire a large dependency tree in a single generation step. Known vulnerabilities in those packages are public by definition, which makes this the cheapest class of finding to fix and the least excusable to ship.

Integrations that trust their input

Webhook handlers that never verify a signature, endpoints that accept an identifier from the request and act on it, and error responses that return internals. Each is individually small and each is a way in.

What is a vibe code audit?

An independent check of an application that was largely written by an AI coding tool. It tests named technical controls against published standards and records how strong the evidence behind each result is, so the answer is verifiable by someone who was not involved in building it.

Do you need access to my repository?

No. A URL scan needs only the address and tests the deployed application from outside. Connecting a repository adds source-level evidence, and runtime validation adds the strongest, but each layer is optional and the report says which ones ran.

Is my app insecure because AI wrote it?

Not by itself. AI accelerates implementation, which means more software reaches production without anyone having reviewed the decisions inside it. The audit exists to establish what is actually true of your application rather than to assume.

How is this different from asking Claude or Cursor to review the code?

A model reviewing code it wrote inherits its own blind spots, only sees the files in its context, cannot test the running system, and produces a transcript rather than evidence. An audit tests the deployed system, grades each result, and ends in something you can hand to someone else.

What do I get at the end?

A result per control with its evidence grade, an explicit list of controls the run could not cover, and a Passport you can publish if you choose. Publication is yours to decide; nothing becomes public because a scan happened.

Does a passing result mean my app is secure?

It means the controls that were tested passed at the evidence strength recorded. Thirteen controls is a defined floor and not a complete security review, and the report is written to make that distinction rather than blur it.