Works on localhost. Then prod has no env vars set, no health check, and a build that only runs on your laptop. Exam deploy readiness before launch day. codedr.ai

It works on your machine. It also trusts the price the browser sends, ships an API key in the bundle, and leaves every table readable. Exam security before launch. $49.95: buy.stripe.com/3cIfZg7jcf2Og…

Your AI built it in Cursor, Claude Code, or Grok Bot. Ask that same tool for a second opinion before launch day. CodeDR runs right inside it. codedr.ai

Pasting your whole repo into a web scanner to check for leaked keys is its own leak. CodeDR exams your vibe-coded app on your machine. Your code never leaves. codedr.ai

Your AI wrote forty features and zero tests. The first refactor quietly breaks checkout and nobody notices for a week. Free guide to vibe coding without that: codedr.ai/guide/landing.html

Ten test users and it flies. A thousand real ones and every page waits on a 4MB bundle and an unindexed query. Exam performance before launch. $49.95: buy.stripe.com/3cIfZg7jcf2Og…

Aisevak - Overall grade: B-. Structure B | Security C+ | Testing B | Deploy B- | Quality C+ | Performance B- | Architecture B+ Scoped agent tokens + argon2, solid. Gap: install.sh leaves :8080 public and the first visitor to onboarding becomes owner (server.ts:688), with full host access.

Nice job @0xzi11a - Inboxed - Overall grade: A-. Structure A- | Security A- | Testing B+ | Deploy C+ | Quality A- | Performance B | Architecture A- Mail HTML gets a no-script sandbox + its own CSP, images off till asked (HtmlBody.svelte:126). Rare care. Nit: the app window runs csp: null (tauri.conf.json:37).

RAPR AI - Overall grade: B-. Structure B- | Security C | Testing B+ | Deploy B | Quality C+ | Performance B- | Architecture B PIN + lockout work is solid. But /static mounts the project root with no auth (app.py:30). From source, that's where .env, .vault_key and the db live.

Oops - Overall grade: A-. Structure A- | Security B+ | Testing B | Deploy B+ | Quality B+ | Performance B | Architecture A- Store outside the repo, smart. Gap: Bash commands mentioning oops.js skip the snapshot (core.js:78), so "oops.js log && rm -rf src" isn't fully undoable.

ChatVault - Overall grade: B-. Structure B | Security C+ | Testing D | Deploy B- | Quality B- | Performance B+ | Architecture B Path guard's solid. But send_message is on IPC with no UI caller and runs claude --dangerously-skip-permissions hidden (lib.rs:308). I'd drop it.

Well done! @fetijashari - flowreel - Overall grade: A. Structure A- | Security A | Testing A | Deploy A | Quality A- | Performance A- | Architecture A Mail guard runs before any request and the seam gate checks loopback + JSON body, real rails. Only nit: Graph fetch has no timeout (graph.ts:580).

hello-stack - Overall grade: B. Security B-, Tests F, Deploy B+, Quality B+, Perf A-, Structure A-. Sharp: init.sh rotates SECRET_KEY but leaves POSTGRES_PASSWORD=app and pgAdmin admin/admin (.env.example + init.sh).

naga-studio - Overall grade: B+. Sec A-, Tests F, Deploy C, Quality B+, Perf A-, Structure A- Strength: per-device HID attribution, so only the Naga gets rewritten (event-engine.swift:127). No network code at all.

open-dots - Overall grade: C-. Structure B+, Security D, Testing B+, Deploy C+, Quality B+, Perf B+, Arch B. Strength: ~318 tests, zero any/TODO, encrypted creds, locked-down local path. But POST /tasks trusts client user_id+box_id, loading another user's tokens into your box.

vibe-work - Overall grade: A-. NICE WORK! Structure A | Security A | Testing B- | Deploy A- | Quality A | Perf A- | Arch A Strength: Mistral key never reaches the agent. Vibe gets a placeholder, a loopback proxy swaps in the real key. Gap: SSRF guard vw-netguard/src/ip.rs:61 has no tests.

usability-test-mcp - Overall grade: A-. Structure A | Security A- | Testing A- | Deploy B+ | Quality A | Performance A- | Architecture A Browser safety: default-deny + redirect re-checks (driver.ts:59-94). Gap: image fetch follows redirects, no private-IP deny (store.ts:54).

Insomnia - Overall grade: B. Structure B- | Security B+ | Testing F | Deploy B | Quality B+ | Performance A- | Architecture B Strength: root helper allowlists ops and timer seconds; gen markers stop stale jobs from clobbering a newer session (helper/insomnia-helper:58-84).

Waymark - Overall grade: B+. Structure A- | Security A- | Testing B | Deploy B | Quality B+ | Performance B | Architecture A- Local claim holds: zero deps, no backend. Fix: a bad data.json decodes to an empty library, then the next save overwrites it (DataStore load, line 63).

agent-vault - Overall grade: A-. Structure A | Security B+ | Testing A- | Deploy B | Quality A- | Performance A- | Architecture A MCP path is tight. Gap: run injects any secret into any command, no allow list (runner.py:53). A per-secret run opt-in would close it.