It works on your machine. It also trusts the price the browser sends, ships an API key in the bundle, and leaves every table readable. Exam security before launch. $49.95: buy.stripe.com/3cIfZg7jcf2Og…

Your AI built it in Cursor, Claude Code, or Grok Bot. Ask that same tool for a second opinion before launch day. CodeDR runs right inside it. codedr.ai

Pasting your whole repo into a web scanner to check for leaked keys is its own leak. CodeDR exams your vibe-coded app on your machine. Your code never leaves. codedr.ai

Your AI wrote forty features and zero tests. The first refactor quietly breaks checkout and nobody notices for a week. Free guide to vibe coding without that: codedr.ai/guide/landing.html

Ten test users and it flies. A thousand real ones and every page waits on a 4MB bundle and an unindexed query. Exam performance before launch. $49.95: buy.stripe.com/3cIfZg7jcf2Og…

Aisevak - Overall grade: B-. Structure B | Security C+ | Testing B | Deploy B- | Quality C+ | Performance B- | Architecture B+ Scoped agent tokens + argon2, solid. Gap: install.sh leaves :8080 public and the first visitor to onboarding becomes owner (server.ts:688), with full host access.

Nice job @0xzi11a - Inboxed - Overall grade: A-. Structure A- | Security A- | Testing B+ | Deploy C+ | Quality A- | Performance B | Architecture A- Mail HTML gets a no-script sandbox + its own CSP, images off till asked (HtmlBody.svelte:126). Rare care. Nit: the app window runs csp: null (tauri.conf.json:37).

RAPR AI - Overall grade: B-. Structure B- | Security C | Testing B+ | Deploy B | Quality C+ | Performance B- | Architecture B PIN + lockout work is solid. But /static mounts the project root with no auth (app.py:30). From source, that's where .env, .vault_key and the db live.

Oops - Overall grade: A-. Structure A- | Security B+ | Testing B | Deploy B+ | Quality B+ | Performance B | Architecture A- Store outside the repo, smart. Gap: Bash commands mentioning oops.js skip the snapshot (core.js:78), so "oops.js log && rm -rf src" isn't fully undoable.

ChatVault - Overall grade: B-. Structure B | Security C+ | Testing D | Deploy B- | Quality B- | Performance B+ | Architecture B Path guard's solid. But send_message is on IPC with no UI caller and runs claude --dangerously-skip-permissions hidden (lib.rs:308). I'd drop it.

Well done! @fetijashari - flowreel - Overall grade: A. Structure A- | Security A | Testing A | Deploy A | Quality A- | Performance A- | Architecture A Mail guard runs before any request and the seam gate checks loopback + JSON body, real rails. Only nit: Graph fetch has no timeout (graph.ts:580).

hello-stack - Overall grade: B. Security B-, Tests F, Deploy B+, Quality B+, Perf A-, Structure A-. Sharp: init.sh rotates SECRET_KEY but leaves POSTGRES_PASSWORD=app and pgAdmin admin/admin (.env.example + init.sh).

naga-studio - Overall grade: B+. Sec A-, Tests F, Deploy C, Quality B+, Perf A-, Structure A- Strength: per-device HID attribution, so only the Naga gets rewritten (event-engine.swift:127). No network code at all.

open-dots - Overall grade: C-. Structure B+, Security D, Testing B+, Deploy C+, Quality B+, Perf B+, Arch B. Strength: ~318 tests, zero any/TODO, encrypted creds, locked-down local path. But POST /tasks trusts client user_id+box_id, loading another user's tokens into your box.

vibe-work - Overall grade: A-. NICE WORK! Structure A | Security A | Testing B- | Deploy A- | Quality A | Perf A- | Arch A Strength: Mistral key never reaches the agent. Vibe gets a placeholder, a loopback proxy swaps in the real key. Gap: SSRF guard vw-netguard/src/ip.rs:61 has no tests.

usability-test-mcp - Overall grade: A-. Structure A | Security A- | Testing A- | Deploy B+ | Quality A | Performance A- | Architecture A Browser safety: default-deny + redirect re-checks (driver.ts:59-94). Gap: image fetch follows redirects, no private-IP deny (store.ts:54).

Insomnia - Overall grade: B. Structure B- | Security B+ | Testing F | Deploy B | Quality B+ | Performance A- | Architecture B Strength: root helper allowlists ops and timer seconds; gen markers stop stale jobs from clobbering a newer session (helper/insomnia-helper:58-84).

Waymark - Overall grade: B+. Structure A- | Security A- | Testing B | Deploy B | Quality B+ | Performance B | Architecture A- Local claim holds: zero deps, no backend. Fix: a bad data.json decodes to an empty library, then the next save overwrites it (DataStore load, line 63).

agent-vault - Overall grade: A-. Structure A | Security B+ | Testing A- | Deploy B | Quality A- | Performance A- | Architecture A MCP path is tight. Gap: run injects any secret into any command, no allow list (runner.py:53). A per-secret run opt-in would close it.

It runs. Then every edit feels risky because nothing was linted, typed, or cleaned up. Exam code quality before the mess hardens. codedr.ai