Vibe-coded app audit
Built an app with AI inside your company and now deciding whether it is safe to run for real? I will go through it as a developer with twenty years of experience and tell you plainly what risks it carries and what to do about them.
Who the audit is for
The typical situation looks like this: the owner or someone in management used tools like Claude Code, Cursor, or Codex to build an app that genuinely works. It solves a real problem, people use it, and now a decision has to be made. Open it to customers? Connect it to sensitive data? Hand it over to developers?
That is exactly the moment to have someone who builds software for a living look at it. AI tools can write a working application, but without experienced oversight they leave behind mistakes that only show up in production: passwords stored directly in the code, gaps in permissions, or data that silently corrupts on errors.
The audit is not a judgement of whoever wrote the app. A vibe-coded application that solves a real problem is a good start. The audit tells you what to finish so the rest of the journey is safe too.
What you get
Written report
A list of identified risks ordered by severity, written so that a non-developer can follow it. Each finding explains what it means for your business.
A 90-minute consultation
We go through the report together. I explain the context, answer questions, and we discuss what to address now and what can wait.
Recommended next steps
You leave with a clear picture of what to fix before launch, what to watch during further development, and whether the app is a solid base to grow on.
What risks I look for
This is not a formal code-quality checklist. I care about what could genuinely harm or slow down your business.
Leaked sensitive data
Passwords and API keys written directly in the code, real customer data in the repository or in saved AI conversation history. Frequent findings with direct GDPR impact.
Access and permissions
Who can reach what. I regularly find parts of an app where permission checks are missing and any signed-in user can trigger sensitive operations.
Operations and deployment
Where and how the app runs, what happens during an outage, whether backups exist, and whether changes can be tested safely outside production.
Data consistency
Whether data can silently corrupt or drift from reality: half-finished operations, deletions without a trace, rules that can be bypassed.
Dependencies and communication
Which external services the app relies on, how securely it communicates with them, and what happens when one of them goes down.
Extensibility
How expensive further development will be. Whether another developer can find their way around the code, or every change risks breaking something else.
How the audit works
Intro call
We briefly cover what the app does, what it is built with, and what you expect from the audit. By the end of the call you know the exact scope and timeline.
Repository access
An invite to the repository on GitHub or GitLab is usually enough. A monorepo or multiple repositories is fine; the price is per project.
Analysis and report
I go through the code and the operational setup and send a written report with risks ordered by severity within a week.
90 minutes over the report
We walk through the findings together and agree on what comes next. That is where the audit ends. If you want help fixing things, we can talk about a next step, but it is not a condition.
Who will look at your application
My name is Marek Andrášik. I have been building software products for almost twenty years, worked on three global products, and have over a hundred projects behind me.
I use AI tools in my own development every day, so I know their strengths and the mistakes they leave in code. The conclusions and recommendations in the report are mine. I put my name behind them and I will personally explain and defend them during the consultation.
Frequently asked questions
What is a vibe-coded application?
An application written mostly by AI tools such as Claude Code, Cursor, or Codex, usually by someone who does not develop software for a living. A person writes the instructions, AI writes the code. This is called vibe coding.
The app was written by someone from management. Is that a problem?
That is the most common case, and it is good news: a tool now exists that genuinely helps the company. The audit is there to make sure a good idea does not turn into a security incident once the app handles sensitive data or customers.
What will you need from us?
A short intro call and then access to the repository, typically an invite on GitHub or GitLab. Everything else we arrange on the call.
How long does the audit take?
I send the written report within a week of getting repository access. Then we schedule the 90-minute consultation to walk through it.
How much does the audit cost?
The price is 12,000 CZK excl. VAT per project. It covers the analysis, the written report, and the 90-minute consultation over the results.
What if the audit finds serious problems?
Most findings can be fixed; it is rare that an app needs to be thrown away and rewritten. Each risk in the report has a severity, so you know what to resolve before launch and what can wait.
Can you also help fix the findings?
If you want, I can propose a remediation plan, do the fixes myself, or go through them with your developer. The audit also works on its own; no follow-up order is required.
Does the audit make sense for apps from tools like Lovable or Bolt?
Yes. Most applications I audit come from Claude Code, Cursor, or Codex because they tend to be more complex. What matters is whether the app handles real data and whether the company depends on it, not which tool it came from.
Want to know where you stand?
We start with a short call. You tell me what the app does, and I will tell you plainly whether the audit makes sense for you.