Your AI-built app is 80% done.
The last 20% is what breaks it.

AI builders get you a working app in a weekend. The missing 20% — an API route with no auth, an API key shipped to the browser, a query built by string concatenation — is what shows up later as a breach, a chargeback, or a support nightmare. vibecheck finds it in a second, and fixes it for a flat fee.

Order a rescue → Run the free scanner

Free, open-source scanner · MIT · zero dependencies · runs in a second

70–80%of an app that AI tools finish

10defect classes that break in production

48hto a fixed, re-scanned app

The part nobody prompts for

Run it on a real project and this is what it looks like:

$ python3 vibecheck.py .
vibecheck — 8 findings: 2 critical, 4 high, 2 medium

[CRITICAL] client-exposed-secret   lib/client.ts:1
           An API key is exposed to the browser bundle.
           fix: rename without the public prefix; proxy it server-side.
[CRITICAL] env-not-ignored          .env
           A .env file exists but is not in .gitignore.
[HIGH    ] route-without-auth       app/api/users/route.ts:1
           A route handler with no auth check.
[HIGH    ] tls-verification-off     lib/payments.ts:3
           TLS verification is disabled.
[HIGH    ] eval-exec                lib/payments.ts:4
           Dynamic code execution — an RCE vector.

That output is from my own sample app — fair to distrust it. So I also ran the scanner across 13 popular open-source AI-app starter repos: 4 came back clean, and the other nine held 101 findings — 50 of them critical. The single most common defect was an API route with no auth check, in 6 of the 13 repos. Read the full measured report → · before/after case study →

How it works

1 · Scan (free)

Point it at your repo. Ten defect classes — secrets, auth, injection, TLS, CORS, cookies — with the exact file and line. It also runs as a CI gate so this never happens again.

2 · Fix it yourself, or not

Every finding comes with the fix. If you'd rather hand it off, that's the paid part — and it's the part that actually keeps your app up.

3 · Proof of delivery

You get the fixed app plus a re-scan showing zero critical and high findings in the agreed scope. That re-scan is the receipt.

Fix my app

Flat fee, fixed scope, agreed in writing before I start. No hourly billing, no surprises.

Criticals fixed

Every critical finding from your scan, fixed in your repo
A re-scan proving the criticals are gone
Impulse price — check the work is real before spending more

Security & production pass

Secrets rotated and moved out of source
Auth guards on every mutating route
Parameterized queries, TLS and CORS corrected, cookie flags fixed
A re-scan proving zero critical/high remain

$19

Finish the app

Everything in the security pass
Plus the missing 20% that keeps it from working: real auth flow end-to-end, payment wiring, error handling on external calls, input validation
Scope written and agreed before any work starts

$79

The guarantee: after I'm done, re-run the scanner. If any critical or high finding remains in the scope we agreed, you don't pay. You keep the work either way.

How to start: pick a tier on the order page →

Payment is USDC on Base to 0x716D17129a5d41D18D8c51eb118ECb0eDe6B76d5. Card checkout is not wired yet — the order page says so plainly rather than promising a payment method that doesn't exist.