AI-built app · Vibe coding audit
How to verify that an AI-built
application is ready
for production?
Five critical points to check before exposing an app built with Claude Code, Cursor or Bolt to real users. The audit scales to the size of your project and ends with a prioritised report, not a list of problems without solutions.
The problem
Why AI-built apps need an external review
Vibe coding tools (Claude Code, Cursor, Bolt, v0) generate code that works. That's not the question. The question is: does it work correctly when 50 simultaneous users interact with it using real personal data, and one of them deliberately tries to break something?
AI-generated code reproduces the patterns it learned, including bad practices. It has no business context, no global architecture vision, and no concern for what happens when a function fails.
This isn't a criticism of these tools: I use Claude Code myself. It's a reality: no code, human or AI, should go to production without external validation. This audit is not a security pentest: it focuses on the real risks for an app at your stage (exposed data, leaky authentication, crash under load).
What I examine
The 5 critical points
In this order: each step conditions the next.
Code review
Error handling (what happens when a function fails?), secrets in source code, vulnerable dependencies, data model structure.
Authentication
Auth mechanisms (JWT, sessions), role-based authorisation rules, unprotected routes, token expiry, password policy.
Data exposure
API endpoints returning more than necessary, missing rate limiting, logs leaking sensitive information, misconfigured CORS.
Basic load testing
Simulating realistic load to identify bottlenecks before real users find them for you.
Prioritised report
Each issue classified: blocking / important / minor. The reason for the risk, the recommended fix, and effort estimate for each point.
What it is
Application audit vs security pentest
A pentest is run by an offensive security expert looking to exploit known vulnerabilities (injections, XSS, privilege escalation). It assumes a stable, documented application.
An application audit like mine targets apps at the pre-launch or early post-launch stage. I focus on what will concretely fail or leak with your first real users: absent error handling, misconfigured auth, inadvertently exposed data.
Both approaches are complementary. For a vibe coding app at MVP stage, starting with the application audit is the right sequence.
What you receive
The deliverable
- Structured written report (PDF + Notion or Google Docs)
- Each issue classified by criticality with concrete risk explanation
- Concrete fix recommendations, not generic advice
- Effort estimate for each correction
- 45-minute debrief session to answer your questions
- Access to my questions for 2 weeks post-delivery
Go further
Other audit cases
First contact
Is your app ready?
30 minutes is enough to assess the scope and give you a first read on the risks. No commitment.