Is a vibe-coded app less secure than a hand-written one?

Not inherently — humans ship all of these too. The difference is that the mistakes are more predictable, which makes them faster to find and cheaper to close.

Do you do penetration testing?

No. This is a code-level security read: we look at how the software can be misused, not at breaking into your running systems. If you need a formal pen test, we will say so.

I found an API key in my front-end code. What now?

Rotate it first — assume it is compromised — then move the new one server-side. Deleting it from the code is not enough; it is in your git history and in every copy of the old build.

Does the $50 pass include security, or is that extra?

It is included. Security is the first thing read, because it is the category where the cost of missing something is unbounded.

LAUNCH

The doors vibe-coded apps leave open.

Vibe-coded apps leak in predictable places: a key shipped to the browser, database rules left open, an endpoint that trusts an id the client sent, uploads with no limits. Humanized Code checks those first for $50 and returns written findings and a fixed quote to close them, within 48 hours.

Where generated apps actually leak

The pattern is consistent, and it comes from a reasonable place: at every fork, the assistant takes the path that makes the feature work now. An API key ends up in the front-end code because that is the version that ran. Database access rules stay permissive because tightening them broke the page. An endpoint accepts a user id from the browser and trusts it, so changing a number in the address bar shows you someone else's records. File uploads accept anything of any size. An admin page is protected by not being linked from anywhere.

Every one of those is a working feature and a door. They are also, being predictable, exactly what a reviewer looks for first — which is the good news buried in this.

Three checks you can run today

Load your live site, open the browser developer tools with F12, and run a search across everything the page pulled in — Cmd or Ctrl + Shift + F — for the first few characters of each API key. View-source alone will miss it: on a React or Next app that page is a nearly empty shell and the real code arrives afterwards. Anything you turn up is public and needs rotating, not hiding.

Open your app in a private browsing window, signed out, and paste in a URL that only a logged-in user should see. If the page loads, your access control is decoration.

Sign in as yourself, find a place where a record id appears in the address bar or a network request, and change it. If you can see somebody else's data, that is the most common serious flaw in generated software and it is worth stopping to fix.

$50 FLAT — FINDINGS + A FIXED QUOTE IN 48 HOURS

$50

Flat initial review

48h

Written findings + fixed quote

START THE REVIEW

EMAIL US INSTEAD

FAQQUESTIONS ABOUT THIS REVIEW

Is a vibe-coded app less secure than a hand-written one?: Not inherently — humans ship all of these too. The difference is that the mistakes are more predictable, which makes them faster to find and cheaper to close.
Do you do penetration testing?: No. This is a code-level security read: we look at how the software can be misused, not at breaking into your running systems. If you need a formal pen test, we will say so.
I found an API key in my front-end code. What now?: Rotate it first — assume it is compromised — then move the new one server-side. Deleting it from the code is not enough; it is in your git history and in every copy of the old build.
Does the $50 pass include security, or is that extra?: It is included. Security is the first thing read, because it is the category where the cost of missing something is unbounded.

RELATEDMORE WAYS WE CAN HELP

TRUSTA security read of the code AI wrote for you.→TRUSTIs AI-written code safe? It depends where you look.→LAUNCHA launch checklist for software AI wrote.→LAUNCHFrom vibe-coded to something you can charge for.→