A nine-dimension audit for solo founders, indie hackers, and pre-launch teams who shipped a vibe-coded MVP and now need it to not fall over the moment users show up.
// the gap
The code runs on your laptop. It even runs on Vercel. But what happens when 5,000 people show up at once, a database query goes rogue at 3am, or someone finds the unguarded admin route the model wrote three weeks ago?
No logs, no metrics, no alerting. When something breaks, you find out from an angry user on Twitter — if you're lucky.
Prompt-injected SQL, exposed env vars, public Supabase keys, missing auth on routes the model "thought were internal".
Six months in, every change breaks two other things. The fastest way forward is to rewrite. The audit shows you what to refactor first.
// what we audit
Every dimension is scored 0–100, with a prioritized list of issues, severity ratings, and concrete fixes you (or your AI) can ship as PRs.
Dead code, duplication, type safety, naming consistency, dangerous patterns, lint gaps.
eslint · complexity · error handlingTest coverage, critical-path coverage, flaky tests, missing edge cases, no-test-at-all reality checks.
unit · e2e · integrationAuth gaps, exposed secrets, input validation, SQL/NoSQL injection, OWASP top 10, leaky API routes.
authz · secrets · OWASPModule boundaries, cyclomatic complexity, file size, documentation, "what does this even do" smell.
cohesion · complexityLogs, metrics, traces, error tracking, alerting, SLO readiness. Can you tell something's broken before users do?
logs · metrics · tracesN+1 queries, missing indexes, blocking I/O, bundle size, caching strategy, what dies at 10× traffic.
queries · caching · bundleCoupling, layering, state management, leaky abstractions, what to refactor before it's a rewrite.
coupling · layersBuild pipeline, deploy reliability, environment parity, rollback story, secret management, branch hygiene.
CI · deploys · envsIdle resources, oversized instances, untuned databases, unnecessary third-party SaaS, the bill at 100× scale.
infra · SaaS · scale// how it works
Paste a public repo URL, wait for the scan to finish, then open the evidence by section.
The free scan runs on public GitHub repositories. No signup required, no install required, no card required.
CodeClanker reads repository metadata and key files, checks dependencies against OSV.dev, scans for committed secrets, and then scores nine readiness dimensions.
You get a summary plus dedicated pages for security, dependencies, code quality, deploy readiness, tests and infrastructure.
// sample report
Representative excerpt from the browser report: scored dimensions, severity-tagged findings, and concrete evidence paths.
The full SERVICE_ROLE_KEY is imported into client code, bypassing all row-level security. Anyone who opens DevTools has god-mode on your database.
The checkout route has a try/catch that logs to console.error and returns a generic 500. There's no Sentry, no log aggregation, and no alert. You have no idea this is firing.
For each project the dashboard fetches members one row at a time. At 50 projects you're firing 51 queries serialized. A single join brings p95 under 120ms.
strict: false was committed three months ago, and there's no CI step running tsc --noEmit. Roughly 280 untyped anys have crept in since.
A read replica was provisioned during testing and never attached to a connection pool. It's been sitting empty for 90 days at production tier.
// what you get
Built to make first action obvious: what is risky now, where the evidence is, and what to open next.
A scored summary page with per-dimension bars and short explanations of where readiness is weakest.
Real CVE, secrets, and deploy findings are grouped by area, with the highest-risk evidence surfaced first.
Every report says what it actually inspected, so unknowns show up as unknowns instead of false all-clear claims.
Jump straight from summary into Security, Dependencies, Code, Deploy, Tests, and Infrastructure for deeper evidence.
Need a deeper human audit with triaged fix planning? Email hello@codeclanker.com. Typical turnaround is three to five business days.
// who it's for
You shipped your first $1k MRR with Cursor and a coffee. Now real users are stress-testing things you never thought about.
You don't read code, but you raised on the prototype. Before you hire your first engineer, find out what they're walking into.
Launch is in three weeks. You'd rather hear "this will break" from us than from Hacker News at 9:47am the morning of.
// faq
Read-only access only — to a temporary user we ask you to revoke after delivery. NDAs available on request. We do not train on your code, share it, or keep copies after the audit closes. Encrypted at rest, deleted within 30 days.
Anything mainstream: Next.js, React, Vue, SvelteKit, Remix, Node, Python (Django/FastAPI/Flask), Go, Ruby on Rails, plus typical stacks around Supabase, Postgres, Redis, Vercel, Render, AWS, GCP. If you're on something exotic, ask — we'll tell you honestly whether we're the right fit.
The free automated scan usually finishes in a couple of minutes. If you want a human audit afterward, that engagement typically takes three to five business days.
The free scan points to the highest-risk areas and evidence paths. For deeper remediation planning or implementation support, we offer a paid human audit and follow-up work.
It depends on codebase size, stack complexity, and turnaround. Every engagement starts with a free scan and a transparent quote — no commitment until you've seen what we're going to deliver.
An automated pass that scores all nine dimensions and opens a multi-page report in your browser, usually within a couple of minutes. It is enough to expose top risks before you decide on a deeper human audit.
Drop your repo. You get a full nine-dimension report in this page, usually within a couple of minutes. No card required.
We have your details and will be in touch about the audit. To get an instant automated report right now, paste a public GitHub repository URL above.