The 30-Minute Vibe-Coded App Audit: Run It Yourself First

This is a checklist you run yourself. Twenty-five checks in six sections, about five minutes each. Most of them need a dashboard and a logged-in browser, not a terminal. Answer each one yes or no. "I don't know" counts as no, because in production it behaves like one.

It's the other half of the eleven greps. Those read the code for fingerprints. This one tests the product and the accounts around it: who can log in, what they can reach, where the money goes and what happens when something breaks. If you'd rather see what a paid audit sends back, that's in our sample report.

Grab whoever built it, if that isn't you. Set a timer.

Section 1. The repo (5 minutes)

1. The README explains how to run the project locally, and it's still true.
2. A fresh clone starts with npm install && npm run dev, or your stack's equivalent, with no tribal knowledge.
3. No .env file is committed. Type .env into the "Go to file" box on GitHub to check.
4. You can read the last 50 commit messages and say what each one changed.
5. main is protected: nobody can force-push to it or merge without a pull request.

Section 2. Logins and roles (5 minutes)

1. You can name the one auth provider. "Supabase, but there's also a NextAuth thing" is a no.
2. You know where the session lives (a cookie or local storage) and when it expires.
3. While logged in, copy a request that loads private data from dev tools as cURL. Delete the cookie or Authorization header and run it. The API refuses.
4. You can list the roles (free, pro, team, admin) and point to the server code that enforces each one.
5. Logged in as a normal user, change a record ID in a URL or request to someone else's. You get refused.

Section 3. Data (5 minutes)

1. Every table has row-level security switched on, or the database can only be reached from your server.
2. Migrations live in git.
3. The schema in git matches production.
4. Backups are on, and someone restored one and checked the data in the last three months.

Section 4. Money (5 minutes)

1. The Stripe secret key is used in one place, on the server. Search the repo for STRIPE_SECRET and sk_live.
2. You know where the webhook handler lives, and the webhooks page in the Stripe dashboard shows recent deliveries succeeding.
3. The handler verifies Stripe's signature before it trusts an event.
4. A webhook delivered twice doesn't double anything. Stripe says plainly that the same event can arrive more than once.

Section 5. Secrets (5 minutes)

1. There's a written list of every API key the app uses.
2. For each key, you know where it's stored and who can see it.
3. If you left today, the next person could rotate every key in 30 minutes without taking production down.

Section 6. Error tracking (5 minutes)

1. When a customer says "it's broken", you know the first place you'd look.
2. Uncaught errors land somewhere a person sees them, such as Sentry, not only in a console nobody reads.
3. You know the normal response time of your busiest endpoints.
4. You'd hear the site is down from a monitor before you'd hear it from a customer.

Your score

Count the no's.

• 0 to 5. You're in decent shape. Fix what you found and ship the next feature.
• 6 to 10. Do a tightening pass before the next feature. Each fix is usually small. The hard part is doing them first.
• 11 to 15. The gaps now touch each other. A weak login check plus an open table is one incident, not two. Get someone who didn't build it to look.
• 16 or more. Stop shipping features until the foundation is fixed. Every new feature adds to what has to be unwound later.

What thirty minutes can't tell you

This checklist finds missing pieces. It can't tell you how they interact, or which fix has to land first. A missing tenant check might be one line or a redesign, and from the outside the two look identical.

That's the gap between a self-audit and a paid one. When we took over Oria, finding the problems was the short part: broken authorization, organizations seeing each other's data, broken uploads, no deploy process, hardcoded secrets, no tests. The real work was sorting the code into keep, fix and replace underneath a product that twelve institutions were already using.

If you scored under 6, you probably don't need us. Keep the list and run it again before your next big launch.

Related reading

• Anatomy of a vibe-coded SaaS: eleven things you can grep for before lunch: the code-side companion to this checklist
• What a $500 code audit report looks like: what comes back when someone else runs the audit
• We inherited an AI-generated codebase. Here is what we found: the six findings from a real rebuild

Built with a specific tool? Lovable, Bolt, Cursor, Replit Agent. No tests yet: start here. The service: Vibe Code Rescue.