Guides
The bugs vibe-coded apps ship with, and how to fix them before launch.
Every guide is written from findings our audits actually confirmed in real repositories: public open-source starters are named with file and line, everything else is anonymized. Each one ends with a prompt you can paste into your AI editor.
Pre-launch guides
The most common serious problem in AI-built web apps is a server endpoint that does real work (reads private rows, writes data, spends money on an LLM or Stripe call) without first confirming who is calling and whether they own the thing they are touching. This guide covers why it keeps appearing, how to find it in your own repo, real instances from public starters, and how to fix it before launch.
Every LLM or image-model call your server makes costs money. If the route that triggers it has no authentication, no rate limit, no input cap and no spend ceiling, anyone on the internet can run it in a loop on your bill. This guide covers why AI-generated apps ship with this problem, how to find it in your repo before launch, what it looks like in three well-known public starters (mckaywrigley/chatbot-ui, vercel/ai-chatbot, Nutlope/roomGPT), and how to fix it in one pass with a Cursor or Claude Code prompt.
Billing code generated by AI tools usually works on the happy path and breaks on the second click, the unhandled event, or the fresh Stripe account. This guide covers why that happens, what to grep for in your own repo, what it looks like in a widely copied public starter, how to fix it with one prompt, and what to verify before you take real money.