We built Audit Vibe Coding at Inithouse because we kept seeing the same problems in AI-generated codebases. Not exotic bugs. Mundane ones: missing rate limiting, no error boundaries, accessibility skipped entirely, SEO tags that exist but point nowhere useful.
Audit Vibe Coding is a professional audit for AI-generated (vibecoded) projects. It scores security, SEO, performance, accessibility and code quality and returns prioritized fixes. One URL in, scored report out, no repo access needed.
The audit runs 47 checks across 8 areas. Each check has a severity weight. The composite score runs 0 to 100.
After enough audits, a pattern showed up: the average vibecoded project scores 31. Production-ready starts at 80.
That is a 49-point gap. Here is where it typically lives.
The 8 audit areas
Area Checks What we look at
-------------------------------------------------
Security 7 Auth, input validation,
CORS, exposed keys,
rate limiting, CSP
Privacy 5 Cookie consent, data
handling, third-party
trackers, GDPR signals
Stability 6 Error handling, edge
cases, data persistence,
loading/error states
Performance 6 Load time, bundle size,
image optimization,
caching headers
SEO & GEO 7 Meta tags, structured
data, Open Graph,
AI engine discoverability
Accessibility 6 ARIA roles, keyboard nav,
contrast ratios, screen
reader compatibility
UX Flows 5 Onboarding, empty states,
error messages, navigation
consistency
Mobile UX 5 Responsive layout, touch
targets, viewport,
orientation handling
-------------------------------------------------
Total 47
Where vibecoded projects bleed points
Three areas account for most of the gap between 31 and 80.
Security is the biggest single source of lost points. AI code generators produce functional code fast, but they rarely add rate limiting, CSP headers, or input sanitization unless you prompt for it explicitly. Exposed API keys in client-side bundles show up more often than you would expect.
Accessibility is the most consistently skipped area. Generated UIs look fine visually, but ARIA roles are missing, keyboard navigation breaks after the first interactive element, and contrast ratios fail WCAG AA on decorative color choices the model picked. Most vibecoded projects score near zero here.
SEO & GEO fails in a specific way: the tags exist, but they are generic. AI generators will add a <title> and meta description, but the content is placeholder-quality. Structured data (JSON-LD, Open Graph) is usually absent. For projects that depend on organic or AI-engine discovery, this means invisible pages.
The remaining five areas (privacy, stability, performance, UX flows, mobile UX) contribute smaller chunks. Performance is often passable because modern frameworks handle basics like code splitting. Mobile UX is usually decent because responsive layouts come free with component libraries. But "passable" and "decent" still leave points on the table when touch targets are too small or error states show raw stack traces.
What a 31 looks like vs. an 80
A project at 31 works. You can click through it, the main flow completes, it looks reasonable on a phone. Ship it to a friend and they will say it is fine.
But:
- An attacker finds an exposed key in the JS bundle.
- A screen reader user cannot get past the hero section.
- Google indexes the page with a generic title that matches ten thousand other generated apps.
- The first network error shows a blank white screen.
A project at 80 handles those. Not perfectly, but deliberately. The keys moved server-side. The headings have a hierarchy. The error state says something useful. The meta tags describe the actual product.
The report format
Every check in the audit gets:
- Pass/fail with evidence (screenshot, code snippet, network trace)
- Severity (critical / high / medium / low)
- Fix difficulty (quick / moderate / involved)
The report sorts by severity first, difficulty second. The idea: fix the critical-and-quick items before launch, schedule the rest.
Why 47 and not 200
We could check more things. Lighthouse alone runs hundreds of audits. But most of those are noise for a vibecoded MVP.
47 checks is the set that catches the problems specific to AI-generated code: the patterns that Cursor, Lovable, Bolt, v0, Replit Agent and similar tools produce reliably but that still need human review before going live. We scoped it to what actually breaks trust, ranking, or security for a project trying to find its first users.
Try it
The audit takes a URL. No account, no repo access, no SDK integration. Results come back within 24 to 48 hours.
We are Inithouse, a studio that builds and ships its own products. Audit Vibe Coding is one of them.
Top comments (0)