Vibe to Production: Pre-launch App Audit

Your AI built the app. Find out if it is actually ready to ship.

Vibe to Production is a pre-launch production-readiness audit for web apps and SaaS built with Cursor, Claude Code, Codex, Lovable, Bolt, Replit or v0. It is not a style review. It ranks what will cause real incidents after launch (account takeover, data leaks, money loss, outages, invisibility to search), worst first, and tells you what can safely wait.

Built for solo founders and small teams about to launch, agencies handing an app to a client, and anyone who shipped faster than they could review.

What you get

A finding looks like this

[P0][CRITICAL] Role taken from the request body  (VTP-001)

Why it matters  A client-supplied role lets any caller grant themselves admin.
Evidence        app/api/admin/users/route.ts:3
                const { isAdmin, userId } = await req.json(); the only check is if (!isAdmin)
Confidence      VERIFIED
Fix             Derive identity and role from the server-side session/DB only.
Effort          S    Fix before launch: YES

Every finding points at a line you can open. Anything not confirmed by reading the code is labelled INFERRED.

What it checks

• Auth and authorization: admin bypass, IDOR, roles taken from the client, client-only permission checks, mass assignment, Supabase RLS, Firebase rules
• Secrets: exposed keys (values are always masked, never printed), committed .env files, keys leaking through public prefixes such as NEXT_PUBLIC_ or VITE_, service-role keys in the browser
• Injection: SQL, NoSQL, command and code injection, SSRF, path traversal, XXE, template injection, XSS, open redirects, ReDoS
• Payments: unsigned Stripe webhooks, client-set prices, missing idempotency
• Data: plaintext passwords, missing validation on writes, unbounded queries, destructive migrations
• Deploy and operations: build blockers, debug mode, CORS, security headers, cookie flags, rate limiting, error tracking, health checks, tests on critical paths
• Search and AI visibility: SEO, AEO, GEO, LLMO, and Naver (NEO) for Korean sites. Areas it did not actually read are labelled structure only and left out of the score

Automated rules: Next.js / React, Express / Node, Supabase, Django / DRF, FastAPI, Flask and PHP. Other stacks are audited by reading the code against the same checklists, and the report says so.

How it works

1. Run it where your code is: in Claude Code, open your project and ask for an audit (add the live URL if you have one).
2. Scanners: it detects the stack, then runs secret, static and search-visibility scanners over the code.
3. It reads the code: every candidate is traced through routes, middleware and data access. False alarms are cleared and listed as such; issues only reading can find are added.
4. Optional live checks: headers, TLS, cookies and public pages, only on a site you own or are authorized to test.
5. Report: ship decision, scores, findings, fix prompts and the HTML dashboard.
6. Fix and re-audit (only if you ask): smallest change per issue, then a before/after diff.

Example requests

• "Audit this app before launch."
• "Focus on Supabase RLS and who can read whose data."
• "Is my Stripe checkout safe to go live?"
• "Check SEO and AI search readiness for my landing pages."
• "Fix the P0 issues, then re-audit."

Honest numbers

Measured on public, deliberately vulnerable apps the rules were never tuned on (ground truth taken from each project's own documentation before the first scan):

• Scanner alone: 43%, 43% and 76% of documented vulnerabilities flagged across three held-out rounds, with one overstated severity and no other false positives
• Full audit (scanner + code reading, answer key unseen): 15/15 in Pygoat and 5/5 in dvpwa

The scanner is a starting point; the findings come from reading your code. It does not replace a penetration test.

Limits, stated up front

• It reads code. It does not attack your running app or execute your code.
• Business-logic rules that need product knowledge (for example "free users must never see the export button") are checked only when you describe them.
• READY TO SHIP is given only when nothing CRITICAL/HIGH is open and the critical paths (auth, authorization, data, payments) were actually read. The report always lists what was not checked.

Safety

• Audit-only by default. Fixes happen only when you ask, followed by a re-audit. Changes to migrations, billing or the auth flow need your explicit OK.
• Your code is never executed and dependencies are never installed.
• Secret values never appear in the report or the chat.
• Live checks run only on sites you own or are authorized to test.
• Runs on your machine. Your code goes only to the AI model you already use in Claude Code; DEVDH Labs never receives it.

FAQ

What do I need? Claude Code (or another agent that supports Agent Skills) and Python 3.9+. The helper scripts use the standard library only: nothing to install, no network calls unless you ask for live checks.

How do I install it? Unzip the download into ~/.claude/skills/ (all projects) or your project's .claude/skills/, then ask "Audit my app before launch".

One-time price? Yes. Pay once, audit as many projects as you like. Model usage is billed by your own Claude plan or API key, as usual.

My stack is not on the list. Is it still useful? Yes. The checklists are applied by reading the code; you get fewer automated hints, and the report tells you that.

Private repo? No problem. Nothing is uploaded anywhere; the audit runs locally, and secret values are masked in the report.

Can I share the report with a client or investor? Yes. The HTML dashboard is one self-contained file with no secret values in it.

Questions? [email protected]