Taught a Grok bot to audit code. Gave it a repo it had never seen. 13 minutes later: Testing F. Deploy D. Code quality C. Security B.
Plus a fix plan for this week, this month and this quarter. Nothing pushed to your repo.
Sped up to 60 sec. The CodeDR.AI skill pack works in Grok, Claude Code and Cursor: codedr.ai #Grok #xai
Your AI built it in Cursor, Claude Code, or Grok Bot. Ask that same tool for a second opinion before launch day. CodeDR runs right inside it. codedr.ai
Pasting your whole repo into a web scanner to check for leaked keys is its own leak. CodeDR exams your vibe-coded app on your machine. Your code never leaves. codedr.ai
Your AI wrote forty features and zero tests. The first refactor quietly breaks checkout and nobody notices for a week. Free guide to vibe coding without that: codedr.ai/guide/landing.html
Ten test users and it flies. A thousand real ones and every page waits on a 4MB bundle and an unindexed query. Exam performance before launch. $49.95: buy.stripe.com/3cIfZg7jcf2Og…
Aisevak - Overall grade: B-.
Structure B | Security C+ | Testing B | Deploy B- | Quality C+ | Performance B- | Architecture B+
Scoped agent tokens + argon2, solid. Gap: install.sh leaves :8080 public and the first visitor to onboarding becomes owner (server.ts:688), with full host access.
Nice job @0xzi11a - Inboxed - Overall grade: A-.
Structure A- | Security A- | Testing B+ | Deploy C+ | Quality A- | Performance B | Architecture A-
Mail HTML gets a no-script sandbox + its own CSP, images off till asked (HtmlBody.svelte:126). Rare care. Nit: the app window runs csp: null (tauri.conf.json:37).
Oops - Overall grade: A-.
Structure A- | Security B+ | Testing B | Deploy B+ | Quality B+ | Performance B | Architecture A-
Store outside the repo, smart. Gap: Bash commands mentioning oops.js skip the snapshot (core.js:78), so "oops.js log && rm -rf src" isn't fully undoable.
ChatVault - Overall grade: B-.
Structure B | Security C+ | Testing D | Deploy B- | Quality B- | Performance B+ | Architecture B
Path guard's solid. But send_message is on IPC with no UI caller and runs claude --dangerously-skip-permissions hidden (lib.rs:308). I'd drop it.
Well done! @fetijashari - flowreel - Overall grade: A.
Structure A- | Security A | Testing A | Deploy A | Quality A- | Performance A- | Architecture A
Mail guard runs before any request and the seam gate checks loopback + JSON body, real rails. Only nit: Graph fetch has no timeout (graph.ts:580).
naga-studio - Overall grade: B+.
Sec A-, Tests F, Deploy C, Quality B+, Perf A-, Structure A-
Strength: per-device HID attribution, so only the Naga gets rewritten (event-engine.swift:127). No network code at all.
open-dots - Overall grade: C-. Structure B+, Security D, Testing B+, Deploy C+, Quality B+, Perf B+, Arch B. Strength: ~318 tests, zero any/TODO, encrypted creds, locked-down local path. But POST /tasks trusts client user_id+box_id, loading another user's tokens into your box.
vibe-work - Overall grade: A-. NICE WORK!
Structure A | Security A | Testing B- | Deploy A- | Quality A | Perf A- | Arch A
Strength: Mistral key never reaches the agent. Vibe gets a placeholder, a loopback proxy swaps in the real key. Gap: SSRF guard vw-netguard/src/ip.rs:61 has no tests.
usability-test-mcp - Overall grade: A-.
Structure A | Security A- | Testing A- | Deploy B+ | Quality A | Performance A- | Architecture A
Browser safety: default-deny + redirect re-checks (driver.ts:59-94). Gap: image fetch follows redirects, no private-IP deny (store.ts:54).
Insomnia - Overall grade: B.
Structure B- | Security B+ | Testing F | Deploy B | Quality B+ | Performance A- | Architecture B
Strength: root helper allowlists ops and timer seconds; gen markers stop stale jobs from clobbering a newer session (helper/insomnia-helper:58-84).
Waymark - Overall grade: B+.
Structure A- | Security A- | Testing B | Deploy B | Quality B+ | Performance B | Architecture A-
Local claim holds: zero deps, no backend. Fix: a bad data.json decodes to an empty library, then the next save overwrites it (DataStore load, line 63).
agent-vault - Overall grade: A-.
Structure A | Security B+ | Testing A- | Deploy B | Quality A- | Performance A- | Architecture A
MCP path is tight. Gap: run injects any secret into any command, no allow list (runner.py:53). A per-secret run opt-in would close it.
It runs. Then every edit feels risky because nothing was linted, typed, or cleaned up. Exam code quality before the mess hardens. codedr.ai
Vibe coding stacks features fast. Then you get folder soup, circular imports, and one file that owns everything. Exam structure before that becomes the product. codedr.ai