Skip to content

    Free tool

    Vibe-Code Audit

    Is the app you built with Lovable, Cursor, Bolt or Replit ready for real users? Paste a public GitHub URL, answer thirteen questions, and get a readiness score with the launch-blocking gaps first. Nothing is stored; results are shareable by link.

    Reads only the list of file paths via GitHub's public API, in your browser. Private repos can't be read — skip to the checklist.

    2 · The thirteen checks

    01Secrets out of the repo and browserlaunch-blocking

    Are all API keys and secrets out of the repository and out of the browser bundle?

    02Paid APIs called server-sidelaunch-blocking

    Are calls to paid APIs (OpenAI, Stripe, email, SMS) made from a server or edge function — never directly from the browser?

    03Database access ruleslaunch-blocking

    Does every database table have access rules (Supabase RLS, Firestore rules) that stop one user reading another user's data?

    04Auth on the real domainlaunch-blocking

    Do sign-in, sign-out, refresh and password reset all work on your real domain and on a phone?

    05Separate environmentsimportant

    Do you have separate development, preview and production environments with their own configuration?

    06Live-mode payment verifiedimportant

    Have you completed one real live-mode payment end to end, including the webhook and a refund?

    07Versioned schemaimportant

    Is the database schema captured as versioned migrations in the repository, and do they match production?

    08Errors handledimportant

    Does a bad input or a failed API call show the user a sensible message instead of a blank screen?

    09Tests on the money pathsimportant

    Are there automated tests around sign-up, checkout and the app's core action?

    10Deploy and rollbackimportant

    Can you deploy from the repository with one command — and roll back in one command if it breaks?

    11Monitoring and alertsimportant

    Would you know within minutes if the app went down or errors spiked — without a customer telling you?

    12Backups testedimportant

    Are database backups automatic, and have you actually restored one to check it works?

    13Real-data performancegood practice

    Have you loaded a page with a thousand or more real records and checked it's still fast?

    Answered 0 of 13

    Answer all thirteen to see your score, the launch-blocking gaps, and the fix for each.

    Get the real audit — two business days→

    Self-assessment plus what a file tree can prove — not a code review. The paid audit reads the code, the database policies and the deploy.

    Questions about the audit

    Start here

    See where your operation is losing time.

    Twenty minutes with an operator, not a salesperson. We'll name the one bottleneck costing you the most — and tell you whether it's worth fixing with software at all.

    Book your free 20-minute consult→

    20 minutes · video call · no preparation needed