Vibe Coded App Audit
A vibe coded app audit for founders who built their product with Lovable, Bolt, v0, Cursor or Claude Code and want to know, in writing, whether it is safe to ship and what it would take to keep running. The whole repository is read in 48 hours, and the verdict is written for the person who built the app, not for another tool. The fixes come priced and in order, so the next step is a decision, not a guess.
What the audit reads in an AI-built app
AI-generated code fails in predictable places, and the audit reads for them end to end:
- Secrets left in the code or shipped to the browser, and the keys the tool created on your behalf.
- Authentication and tenant isolation: whether one user can read another's rows, including the database rules the tool wrote for you (RLS, the row-level security of Supabase and its kind).
- What the tool assumed on your behalf: payments, emails, file storage, the parts it wired without asking.
- Dependencies and their versions, the tests that exist and the ones that do not, and how the app deploys.
The verdict has the same four chapters as our code audit services: the state of the system, what breaks next, the fix list, and what we would do if it were ours. For an app about to launch, the second chapter reads as a go or no-go for shipping, with the conditions written down.
A vibe code audit in 48 hours, in writing
A vibe code audit here runs with no meeting before the verdict. You request the audit, pay, and connect the repository read-only; the 48-hour clock starts from access. You receive the verdict as a PDF written for a founder, then a one-hour debrief to walk through it and answer your questions.
Access is revoked and the working copies are deleted once the audit is delivered. Your code is read by one person and the tooling run for the audit, never used to train anything, never shared.
How pricing works
The audit has one flat price, shown on the code audit services page, paid up front, with nothing to prepare on your side. If the app then moves into La Résidence, the audit is credited against the first month.
Several pages on this search offer a free call first, or a tiered audit capped by the number of endpoints. What the flat price buys here, and what those do not include in one place: the whole repository read, a verdict in writing, the fixes priced, a debrief, and the credit.
Keep it, fix it, or rebuild it
The verdict decides, in writing. Most AI-built apps are kept: the fix list is applied in order, the secrets rotated, the access rules rewritten, the deploy made repeatable, and the app keeps the screens and flows its users already know. Rebuilding is proposed only when the audit says so, with what it costs against fixing.
When the verdict is a rebuild, the prototype becomes the brief: it shows what the product should do, and the product is scoped from it in the Forge, as described in the prototype section of MVP Development Services. To audit AI-generated code is not to judge the tool: the same read is applied to code a freelancer or an agency wrote.
After the verdict: who keeps it running
An AI-built app usually has no developer behind it, so the verdict's last chapter says who keeps it running. Three routes:
- You, with the fix list: each fix is written so you can hand it to your own tool, in the order that matters.
- ITzWorking Agents, for a founder who keeps shipping alone: the cleanup is part of the setup quote, then each change is asked of agents and priced on its own, with nobody on call: AI-generated app maintenance one change at a time, for a founder who wants it that way.
- One person answering for the product, under a guarantee: Fractional CTO for Non-Technical Founders.
Who it is for, and who it is not for
For
- Founders, designers and small teams with an app built in Lovable, Bolt, v0, Cursor, Claude Code or Replit, live or about to launch, holding users' data or payments.
- A founder about to show the app to a customer, a partner or an investor who asks what is under it.
- A vibe coded app audit before the first paying user, when the cost of a leak is still small.
Not for
- A penetration test or a compliance audit (SOC 2, ISO 27001).
- An app still being prototyped, with no users planned.
- Code you do not own or cannot connect read-only.
Questions founders ask
Are vibe-coded apps safe?
Some are, and nothing about the tool says which. The failures are specific: secrets exposed, one user able to read another's data, a deploy nobody can repeat. The audit reads for each and writes down what it found.
How do I know what my AI-built app is made of?
The first chapter of the verdict is that inventory: the services, the data stores, the third parties, the dependencies and their versions, read from the code rather than from what the tool told you.
What is a vibe code audit?
A senior read of an app built with an AI tool, judged as production software: what it does, where it breaks, what to fix first. Here it covers the whole repository in 48 hours and ends in a written verdict.
Which tools do you cover?
Lovable, Bolt, v0, Cursor, Claude Code, Replit, and the rest: the audit reads the code, not the tool. Supabase and Firebase rules are read as code too.
Do I need to be technical to read the verdict?
No. It is written for a founder, and the debrief is an hour to go through it. The fix list is also written so a tool or a developer can act on it.
Will you fix what you find?
Not inside the audit: the vibe coded app audit stays a read, which is what keeps the verdict honest. The fix list is priced, and the three routes above follow it.
How is it different from an automated scanner?
A scanner matches patterns and does not know what your app is for. Here tooling sweeps the repository at machine scale, then a person judges every finding against what the app does and writes the verdict.
Who answers for it
Julien Casse, founder of ITzWorking. Shipping software since 2010: fintech in Luxembourg, then co-founder and CTO of kodehyve, from sole developer to a team of twenty.
He reads the code himself and makes the calls the model cannot. The client list is short on purpose: one named person answers for your product. Read more about the founder
Vibe Coded App Audit