Vibe-Coded App Review
You built your app with Claude Code, Cursor, Lovable, Bolt or another AI agent, and it works. Before you let it near your customers and their data, though, it is worth knowing what is really inside. AI writes fast and convincingly, but it can just as quickly skip a permission check or put a key straight into the code. I use vibe coding every day and teach it, so I know where agents go wrong most often.
Security audit
I go through the code and configuration against OWASP ASVS , focusing on what keeps coming up in AI-written apps:
- secret keys and passwords in the code, in git, or in the JavaScript every visitor downloads
- access control – whether a user can reach another user’s data just by changing an ID in the URL, and whether the backend checks permissions rather than just hiding a button in the frontend
- databases and backend-as-a-service (Supabase, Firebase) – data access rules that are often switched off or far too loose
- login and sessions – password storage, password reset, logout, token lifetime
- input handling – XSS, SQL injection, file uploads
- dependencies – outdated packages with known vulnerabilities, and packages the AI “made up” that someone has since registered
- AI features in the app – prompt injection, data leaking through a chatbot, and what the model is allowed to do on its own
Best practice audit
The second half is about whether the app can keep growing or falls apart with every change:
- code structure – duplication, oversized files and functions, dead code, the same thing solved three different ways
- tests – whether there are any, whether they test what matters, and whether they actually pass
- CI and deployment – automatic checks before deploying, separate development and production environments, configuration kept out of the code
- errors and logging – what users see when something fails, and whether you find out about it
- backups and restore of your data
- documentation and rules for the agent (
AGENTS.md,CLAUDE.md), so further work with AI builds on what is there instead of starting from scratch
What you get
A list of findings ordered by severity. Each one explains why it is a problem, where exactly it is in the code, what I recommend and an effort estimate. On top of that, a short summary: what to fix before launch, what can wait and what is fine.
I can make the fixes straight away, or hand them to your team or your agent as concrete tasks. Checks that can be automated (static analysis, dependency audit, secret scanning) I set up in CI, so they guard every later change.
What I focus on
I work with the application’s code and configuration, whether it is PHP, Python or JavaScript/TypeScript. I do not do infrastructure penetration testing. Other security services are on the Web Security page.
Frequently Asked Questions
Do I need to give you access to production?
No. Access to the source code (a repository or an export) and a description of where and how the app runs is enough.
None of us has read the code – the AI wrote all of it. Is that a problem?
No, this service is made for exactly those apps. I write up the results so that someone who does not write code can follow them.
Can you teach us to do this ourselves?
Yes. How to steer an AI agent so the result stays maintainable and secure is what my Vibe Coding with AI Agents
course is about.