# The Vibe Code Rescue Audit — the exact command we run

Open your project in **Cursor, Claude Code, or your AI coding tool**, and paste the prompt below. It flags the holes AI-built apps almost always ship with — security, scalability and architecture. Read the results with a straight face; the CRITICALs are the ones that get founders breached, sued, or stuck at the payment screen.

---

```
Act as a ruthless senior engineer reviewing THIS codebase for production readiness.
Assume it was built fast with AI and has the classic holes. Do NOT reassure me.
For every issue give: the file/line, a risk rating (CRITICAL / HIGH / MEDIUM), and a one-line fix.

SECURITY
1. Secrets / API keys committed to the repo or exposed in the front-end bundle
2. Auth — are protected routes AND mutations actually checked on the server? Any action that trusts the client for identity or role?
3. Authorization — can user A read or modify user B's data? (row-level / object-level checks)
4. Injection & input validation (SQL / NoSQL / command), plus unsanitised user content (XSS)
5. Sessions / cookies — secure flags, expiry, password hashing
6. Open or unprotected admin / debug endpoints; missing security headers; over-permissive CORS

PAYMENTS (if any)
7. Webhook signatures verified? Idempotent? Does access actually update on the webhook — not just the client redirect?

SCALABILITY
8. N+1 queries and missing database indexes
9. Unbounded queries / no pagination
10. No caching, no rate limiting
11. Heavy work running synchronously in request handlers that should be queued

ARCHITECTURE & RELIABILITY
12. Error handling & logging — or silent failures
13. Config / env management — hard-coded values, missing env vars
14. Tests and CI/CD — do they exist at all?
15. Data integrity — migrations, constraints, backups

Finish with a prioritised list (CRITICAL first) and a one-line verdict:
is this safe to put in front of real, paying users — yes or no, and why.
```

---

**Found something that made your stomach drop?** That's exactly the 20% we fix.
21 years building SaaS for real companies — send us your app and we'll get it launch-ready.
→ **https://vibe.makeitsimple.co.uk**

*Make IT Simple · Trusted. Proven. Simple.*