Your AI built it in Cursor, Claude Code, or Grok Bot. Ask that same tool for a second opinion before launch day. CodeDR runs right inside it. codedr.ai

Pasting your whole repo into a web scanner to check for leaked keys is its own leak. CodeDR exams your vibe-coded app on your machine. Your code never leaves. codedr.ai

Your AI wrote forty features and zero tests. The first refactor quietly breaks checkout and nobody notices for a week. Free guide to vibe coding without that: codedr.ai/guide/landing.html

Ten test users and it flies. A thousand real ones and every page waits on a 4MB bundle and an unindexed query. Exam performance before launch. $49.95: buy.stripe.com/3cIfZg7jcf2Og…

Aisevak - Overall grade: B-. Structure B | Security C+ | Testing B | Deploy B- | Quality C+ | Performance B- | Architecture B+ Scoped agent tokens + argon2, solid. Gap: install.sh leaves :8080 public and the first visitor to onboarding becomes owner (server.ts:688), with full host access.

Nice job @0xzi11a - Inboxed - Overall grade: A-. Structure A- | Security A- | Testing B+ | Deploy C+ | Quality A- | Performance B | Architecture A- Mail HTML gets a no-script sandbox + its own CSP, images off till asked (HtmlBody.svelte:126). Rare care. Nit: the app window runs csp: null (tauri.conf.json:37).

RAPR AI - Overall grade: B-. Structure B- | Security C | Testing B+ | Deploy B | Quality C+ | Performance B- | Architecture B PIN + lockout work is solid. But /static mounts the project root with no auth (app.py:30). From source, that's where .env, .vault_key and the db live.

Oops - Overall grade: A-. Structure A- | Security B+ | Testing B | Deploy B+ | Quality B+ | Performance B | Architecture A- Store outside the repo, smart. Gap: Bash commands mentioning oops.js skip the snapshot (core.js:78), so "oops.js log && rm -rf src" isn't fully undoable.

ChatVault - Overall grade: B-. Structure B | Security C+ | Testing D | Deploy B- | Quality B- | Performance B+ | Architecture B Path guard's solid. But send_message is on IPC with no UI caller and runs claude --dangerously-skip-permissions hidden (lib.rs:308). I'd drop it.

Well done! @fetijashari - flowreel - Overall grade: A. Structure A- | Security A | Testing A | Deploy A | Quality A- | Performance A- | Architecture A Mail guard runs before any request and the seam gate checks loopback + JSON body, real rails. Only nit: Graph fetch has no timeout (graph.ts:580).

jobq - Overall grade: A. Structure A | Security A | Testing A | Deploy B | Quality A | Architecture B | Performance N/A Love that the chaos tests kill -9 real worker processes and every job still finishes, the attempt fencing is the real deal. One fix: leadership is a session advisory lock (leader.go:74), so a hung leader connection keeps the lock and nothing gets rescued. Froze it for 30s in a quick test, no failover.

I use it to login….

what’s your usage look like? #cursor #xai

that’s just PM’s looking for something to do

Taught a Grok bot to audit code. Gave it a repo it had never seen. 13 minutes later: Testing F. Deploy D. Code quality C. Security B. Plus a fix plan for this week, this month and this quarter. Nothing pushed to your repo. Sped up to 60 sec. The CodeDR.AI skill pack works in Grok, Claude Code and Cursor: codedr.ai #Grok #xai

sre-agent / K8s Incident Investigator - Overall grade: B. Real RO SA + HITL allow list (126 tests); lock POST /alerts before leaving localhost.

Auth is more than a login screen. Validate inputs, enforce permissions, and test the unhappy paths before launch. codedr.ai

NotchShot — Overall grade: B. Structure B · Security A · Testing A · Deploy B · Quality B · Architecture A. Local-first notch capture with real Swift Testing and fail-closed Sparkle is rare. Biggest aging risk is the multi-kLOC AppCoordinator.

**EvoMap/AutoResearch** @ `0fa9a93` — Overall **C** Structure C · Security C · Testing B · Deploy C · Quality B · Performance B · Architecture B **1 Critical · 18 High · 31 Medium · 18 Low** Top issues: Alpha + `--dangerously-skip-permissions`, `Bash(*)` agent allowlist, scraped titles into forge prompts, 3.8k-LOC workflow-engine, secrets-only-`.env` / no observability.

**FOMO Robinhood Radar** @ `1c448e9` — Overall **C** Structure B · Security C · Testing B · Deploy B · Quality C · Performance B · Architecture B **1 Critical · 13 High · 29 Medium · 21 Low** Top issues: Astro `define:vars` XSS (`[email protected]`), XFF rate-limit bypass, empty `RECEIVER_TOKEN` fail-open on ingest/seed, no lint/type CI, `/api/hot` N+1.