Vibe Code Audit — Production Readiness Review

You shipped fast with Cursor, Claude Code, Lovable, or v0 — and it works. Then real users show up, or an investor asks about security, or your database bill triples overnight. This audit tells you exactly what will break, in what order, and what it costs to fix.

What I look for

• Exposed secrets — API keys and service-role tokens leaking into the client bundle, committed .env files, credentials still sitting in Git history.

• Broken authorization — endpoints that authenticate but never authorize, open Supabase or Firebase rules, IDOR on any resource with an ID in the URL.

• Data model integrity — missing foreign keys and constraints, no migration history, no backup or restore path, silent data loss under concurrent writes.

• Injection and validation — string-interpolated queries, unvalidated input, mass assignment, unsanitized rendering.

• Dependencies — hallucinated or abandoned packages, unpinned versions, known CVEs sitting in your lockfile.

• Cost and scale traps — N+1 queries, missing indexes, unbounded LLM calls with no rate limit or spend cap, no caching anywhere.

• Operational blind spots — no error tracking, no logs worth reading, staging and production sharing a database, no way to roll back.

• Duplication and dead code — the same logic generated four times in four shapes, and what that costs you on every future change.

• Personal data handling — where PII lives, who can read it, and where you stand against Saudi PDPL and GDPR basics.

What you get

• A written report: every finding ranked P0 (fix before your next user), P1 (fix this month), or P2 (fix when you can), each with the exact file and line, why it matters, and a concrete fix.

• A prioritized remediation plan with effort estimates, so you know what a developer-week actually buys you.

• A 45-minute walkthrough call — screen shared, questions answered, decisions made.

• Seven days of follow-up questions by email after the call.

How it works

1. After purchase you receive an intake form: repository access, your stack, and what worries you most.

2. I audit the codebase by hand — I do not dump your repo into a scanner and forward the output.

3. Your report arrives within 5 business days.

4. We book the walkthrough call whenever suits you, within 14 days of delivery.

What I need from you

• Read-only access to one Git repository (GitHub, GitLab, or Bitbucket)

• A working staging or production URL, if one exists

• The names of your environment variables — never the values

• Anything you already know is held together with tape

Scope

One application, up to roughly 30,000 lines of code. Larger or multi-service systems are quoted on request. This is a code and architecture review, not penetration testing, and it does not include implementing the fixes — remediation is quoted separately once you have the report.