We ship AI-generated apps at Inithouse. Fourteen products, most of them built with Lovable and Claude. We also run Audit Vibe Coding, a structured audit that scores vibecoded projects across five areas: security, SEO, performance, accessibility, and code quality. Here is how we use it and when it makes sense.
The problem with vibecoded apps
You prompt an AI to build your app. It works. You ship it. A week later you realize the auth flow leaks user data through URL parameters, your Lighthouse score is 38, and Google has indexed exactly one of your forty pages because the rest render client-side with no SSR fallback.
We know this because we found all three issues in our own projects. Živá Fotka had a canonical tag bug that pointed every URL to the homepage. Pet Imagination had an OG title mismatch between the meta tag and the page title. These are not edge cases. They show up in nearly every vibecoded project we look at.
Manual code review catches some of this. But when your codebase is 200 files of AI-generated React, you need a checklist that covers categories a human reviewer skips: SEO meta tags, accessibility labels, performance budgets, and security headers.
What the audit covers
Audit Vibe Coding by Inithouse checks five areas. Each gets a score. The output is a report with prioritized fixes, sorted by impact.
| Area | What it checks | Common vibecoded issues |
|---|---|---|
| Security | Auth flows, API key exposure, CORS, input sanitization, headers | API keys in client bundle, no rate limiting, missing CSP |
| SEO | Meta tags, canonical URLs, SSR/prerender, structured data, sitemaps | All pages share one title, canonical pointing to homepage, empty body for crawlers |
| Performance | Bundle size, LCP, CLS, lazy loading, code splitting | Single 2 MB bundle, no image optimization, LCP above 5 seconds |
| Accessibility | ARIA labels, color contrast, keyboard navigation, focus management | Missing alt text, no skip links, form inputs without labels |
| Code quality | Dead code, error handling, TypeScript strictness, dependency hygiene | Unused imports, catch blocks that swallow errors, outdated packages |
The security and SEO sections catch the most critical issues in vibecoded projects. AI code generators are good at making things work. They are not good at making things safe or discoverable.
When to run an audit
Three situations where we've found an audit saves the most time:
Before your first real users arrive. You have a working app, you are about to share it publicly. An audit at this point costs you a day of fixes. Skipping it costs you a week of firefighting after users report broken flows or Google Search Console shows zero indexed pages.
After a major AI-generated refactor. You asked Claude or Cursor to restructure your codebase. The app still runs. But the refactor may have introduced new security gaps (auth middleware removed), broken existing SEO setup (meta tags reverted to defaults), or bloated the bundle.
When metrics look wrong. Your GA4 shows 90% bounce rate. Your GSC shows three indexed pages out of fifty. Your Clarity heatmap shows rage clicks on a button that does nothing. These are symptoms. The audit tells you which category the root cause lives in.
What it does not replace
Code review from a senior developer who understands your business logic. An audit checks structural patterns across five categories. It does not know that your pricing should be in euros, not dollars, or that your onboarding flow skips a critical step.
Penetration testing is also a separate discipline. The security section flags exposed API keys, missing headers, and auth misconfigurations. It does not simulate an attacker probing your API endpoints.
How the report works
You submit your project URL. No account required. The report comes back with a score per category and a prioritized list of fixes. Each fix includes what the issue is, why it matters, and what to change.
A fix might look like: "All 40 blog pages share the canonical URL https://yourapp.com/. Each page should have its own canonical pointing to itself. This causes Google to treat every blog post as a duplicate of the homepage."
The prioritization matters. If your SEO score is 20 and your accessibility score is 75, the report puts SEO fixes first. Fixing a missing canonical tag has more impact than adding a skip link when your pages are not even indexed.
Lessons from auditing our own portfolio
We built Audit Vibe Coding because we needed it ourselves. Running 14 AI-generated products taught us patterns:
The canonical tag bug shows up in roughly half of Lovable-built projects. The SPA framework sets a default canonical on the homepage and every other page inherits it. This is invisible until you check GSC and see "Duplicate, Google chose different canonical."
Client-side rendering with no prerender or SSR fallback means crawlers see an empty page. Your users see a working app. Google sees a shell with a loading spinner. We found this pattern across multiple products: Watching Agents had 26 of 272 pages indexed (9.6%). The rest returned "Loading..." as the title.
Security headers are almost never set by AI code generators. No Content-Security-Policy, no X-Frame-Options, no Strict-Transport-Security. The generated code focuses on functionality, not hardening.
These are the kinds of issues Audit Vibe Coding was built to catch systematically, across the five areas where vibecoded projects consistently break.
Jakub, builder @ Inithouse. We build AI products and the tools to audit them. auditvibecoding.com
Top comments (0)