CodeDR.AI
Your app works. Prove a stranger can’t read the data.
You finished the guide. If the app has (or will have) real users, don't ship on vibes. Run the CodeDR Skill Pack locally: eleven skills, one grade, file:line findings, remediations your agent can apply. We never see your code.
Who Should Use This
Non-technical founders who shipped something real and want to make sure it holds up. Built it with Lovable, Bolt, or Replit, refined it in Cursor, Claude Code, or Grok Bot. It's live. People are paying. The question now is whether the foundation is solid enough to grow on — and you'd rather find out from a report on your own machine than from an incident.
Developers who leaned heavily on AI and aren't sure what the AI got wrong. Speed has a cost. You reviewed less, accepted more, trusted the model in places you'd normally write the code yourself. The skill pack gives you a systematic audit pass from an examiner that doesn't share your assumptions or blind spots — without adding another vendor to your threat model.
What You Get
Eleven skills, same exam. The examiners split the way a real pre-launch review splits:
Security. Systematic pass over the most common failure modes in vibe-coded projects. Auth and authorization gaps — including the classic pattern where the AI implements auth at the login boundary but never propagates ownership checks to the data layer. Exposed env vars and API keys, in the working tree and in Git history. SQL injection surface. Missing rate limiting. Dependency vulnerabilities. These skills find the patterns before a scanner — or a curious user — does.
Testing. The gap between "it works when I click around" and "it's tested." These skills map what your app actually does against what your test suite actually covers, flag the untested paths that matter most (auth flows, payment logic, anything that mutates data), and scaffold the missing tests instead of just telling you they're missing.
Deploy readiness. The blockers that don't show up until you flip the live switch. Unindexed queries that run fine at 50 rows and fall over at 50,000. N+1 patterns generating hundreds of DB calls where the AI assumed a handful. Config that works on localhost and nowhere else. Error handling that leaks internal paths to strangers.
Synthesize. The ninth skill is the one that makes it a diagnosis instead of a pile of findings. It reads every examiner's report and rolls them into a graded diagnosis: a plain-English SUMMARY.md you can hand to a client, a teammate, or an investor without translating, plus a remediation PR template with the fixes prioritized and scoped. High-severity first. You review, you decide, you merge. CodeDR.AI proposes; you dispose.
Pricing
$49.95. One-time. Instant download. No subscription, no seats, no metering. The skills run on the Cursor, Claude Code, or Grok Bot subscription you already have, so the marginal cost of running the exam again next month — or on your next three projects — is zero. Compare that to what a consulting firm charges for one pre-launch audit and the math stops being interesting.
There's no free tier and no catch, because there's nothing to harvest. You're not paying with your codebase, your app's publicity, or your email inbox. You're paying $49.95, once, for a set of skills you own.
Best For: Early-Stage / Shipping-Ready / Live
Early-Stage — ★★★★☆. More useful here than an external audit would be, because you can re-run it for free as the project evolves. Run the security skills from day one and the exam becomes a habit instead of an event. The testing skills are arguably most valuable now, before the untested surface area compounds.
Shipping-Ready — ★★★★★. The sweet spot. App is built, working, you're preparing to launch or just launched and seeing first real users. A full exam at this stage is the pre-launch audit that would cost thousands from a consulting firm, produced in an afternoon, on your own hardware. The SUMMARY.md doubles as the technical due-diligence artifact people will eventually ask you for anyway.
Live Production — ★★★★☆. Still valuable, but be deliberate with the remediation PR. The skills read your code; they don't know your production environment, operational constraints, or edge cases. Treat the PR template as an audit report with proposed remediation, not something to merge directly. Review individually. Test in staging. Deploy with care.
How It Works
Buy the Skill Pack — $49.95. Download lands immediately — a folder of skill files and a two-minute setup guide. Drop them into .cursor/skills/ or .claude/agents/ depending on your editor, or add ExamBot in Grok Bot and attach the zip once. That's the installation.
Run the examiners — individually when you're worried about one thing, or all eight for the full workup. Each skill walks your codebase with your own AI model doing the reading, on your machine, and writes a findings report as it goes. Nothing is uploaded. There's no telemetry, no phone-home, no account. You could run it on an air-gapped laptop and it would work exactly the same.
Then run Synthesize. It collects the reports, grades the app, and produces the SUMMARY.md and the remediation PR template. Every finding is documented with what it is, why it matters, and what the proposed fix does. Push back on anything that doesn't fit your context — you're in your own editor, so pushing back is just typing. Merge what you trust. Leave the rest. Nothing is forced.
The Story
A friend spent four months building a client portal for wedding photographers. Lovable for the bones, Claude Code to refine the auth flow. Launched to her first ten clients in November. They loved it. Started selling access to other photographers in her network.
By February she had forty paying clients and a feeling she couldn't quite name. App worked. Payments processed. Photos downloaded. But she'd been reading enough about vibe-coded apps to know "it works" and "it's secure" aren't the same sentence. Her clients were uploading the most emotionally significant photos of their lives. Which is exactly why she'd refused every code-review service that wanted her to upload the repo somewhere: handing a codebase full of storage credentials and client data to a third party felt like solving a trust problem by creating one.
She bought the skill pack instead and ran the full workup on a Saturday morning, in Claude Code, on the same subscription she'd built the app with.
Three findings graded high in the SUMMARY.md. Most serious: her file download endpoint wasn't verifying that the logged-in user actually owned the files they were requesting. Any authenticated user could guess a file ID and download another client's photos directly. The AI had generated the auth check for the login flow but never propagated authorization to the file access layer — classic, common mistake. The remediation template scoped the fix to two lines of ownership middleware. Second finding: a missing DB index on her most-queried column, which would've caused noticeable slowdowns around 200 clients. Third was minor — error messages exposing internal file paths.
She had the PR merged by Saturday afternoon. Total elapsed time from "vague bad feeling" to "audited and fixed": about five hours, and her clients' photos never touched a server she didn't control.
App is still running. Photos are still safe.
Where It Bites
It's skills, not a consultant. The pack tells your AI what to examine and how to report it. It doesn't argue with you, doesn't know your business context unless you provide it, and won't chase a hunch across three services the way a senior engineer on a bad-feeling day will. Strong systematic baseline. Not a substitute for expert judgment on genuinely novel problems.
Quality depends on the model you run it with. The skills are the exam; your model is the examiner. Run them with a frontier model and you get frontier-grade findings. Run them with whatever cheap model your editor falls back to when you've burned your quota, and you'll get a shallower read. Same skills, different doctor.
Not omniscient. Very good at well-documented classes of vulnerabilities and performance patterns. A sophisticated custom vulnerability — one that emerges from your specific data model and business logic in a way no generic pass would flag — may not appear in the report. For apps handling financial transactions, medical records, or sensitive data at scale: treat the exam as a rigorous first step, then engage additional expertise for what matters at that scale.
Be deliberate merging into production. The remediation template is generated from a read of your code, not your infrastructure. Test in staging first. Particularly for anything touching auth, authorization, or data access.
Gavin's Rule: Check Git History Before Anything Else
First thing after installing the pack — before the full workup, before anything — run the secrets examiner alone.
It searches for
sk-(OpenAI keys).AKIA(AWS). Any file named.envorsecretsthat was ever committed. It checks.gitignorecovers.env, and it checks your repo history — not just the latest commit — for files that were briefly tracked and then deleted.Hardcoded secrets in Git history are the single finding that triggers the most urgent scrambles, because deletion doesn't help. The key lives in history forever. The only fix is rotation, and every hour between discovery and rotation is exposure.
Five minutes. If it's clean, run the rest of the exam with a clear head. If it's not, rotate first — everything else can wait.
Start clean. Then examine.
Bottom Line
Your app works. Prove a stranger can't read the data.
You finished the guide. If the app has (or will have) real users, don't ship on vibes. Run the CodeDR Skill Pack locally: eleven skills, one grade, file:line findings, remediations your agent can apply. We never see your code.
— Gavin