From triage to a product you can defend

A code review looks at a change. An audit looks at the whole system: architecture, dependencies, authentication and authorization, error handling, data flows and infrastructure configuration. For AI-generated codebases we also look for the failure modes specific to them - hallucinated or abandoned packages, duplicated logic that drifted apart, validation that was written for the happy path only, and tests that assert nothing. You receive a written report ranked by exploitability and business impact, plus a remediation estimate.

Yes - vibe code cleanup is the core of our practice, and the tool that produced the code does not change much about the work. Vibe-coded apps usually work for the demo and fail at the edges. We keep what is sound, replace what is not, add the missing validation and error handling, and put tests around the paths that carry revenue. Work arrives as small, reviewable pull requests rather than one large rewrite you cannot check.

It is safe once someone has read it. Vibe coding is very good at producing code that runs and quietly bad at the things that only matter under load, under attack, or at the edges - authorization checks, input validation, secret handling, error paths and concurrency. None of that shows up in a demo. A vibe-coded MVP is a legitimate starting point; taking it to production means auditing it first, fixing what the audit finds, and putting CI gates in place so the next round of generated code cannot reintroduce the same problems.

The OWASP Top 10 and OWASP ASVS form the baseline. On top of that: authentication and authorization logic traced end to end, dependency and secret scanning across your full git history, input validation and injection testing, and a cloud and infrastructure misconfiguration review. Every finding is reproduced by hand before it reaches your report and arrives with the exact steps needed to trigger it, so you never receive raw scanner noise.

Missing or inconsistent authorization on API endpoints, secrets committed during the initial scaffold and never rotated, validation written only for the happy path, unhandled promise rejections that silently drop writes, and dependencies that were hallucinated, abandoned, or pulled in to solve something the standard library already handles. They recur because the assistant optimises for code that runs, not for code that holds under an adversary.

Code audits and security audits are both fixed-price and typically run one to two weeks depending on the size of the codebase and the number of services involved. We quote after a short scoping conversation and a look at the repository structure, so the price you are given is the price you pay. Remediation is quoted separately once you have the findings and can decide what is worth fixing.

Yes. A mutual NDA is signed before any repository access, access is least-privilege and time-boxed, and every deliverable is assigned to you on payment. Client code is never used to train models.

Yes. A due-diligence read produces the same evidence-backed findings written so that a founder, a CTO and an investor can read the same document and reach the same conclusion - plus an honest assessment of what it would cost to bring the codebase to a maintainable state.

Both. We build web applications, marketing sites, dashboards and iOS and Android apps end to end, including release pipelines and App Store or Play Store submission with the privacy declarations. Our own iOS app, Declutta, is built and published by the same team.

Your team receives documentation written for humans, a pipeline that enforces the new baseline, and re-tested findings. If you want ongoing coverage, a monthly retainer gives you dependency patching, pull request review for in-house and AI-assisted work, and incident response within an agreed window.