Vibecode Rescue: Black-Box Product Audits

A fintech earning $192 a month whose signup sits behind the pricing page while every conventional auth route returns 404. 56.5/100 — At Risk.

The highest zero-revenue ask in the corpus. 47/100 — At Risk. Substantial terms of service, a real product on the root, and no way for anyone to create an account.

The best-engineered product in this batch has no privacy policy and no terms — on a tool that stores your clients' email addresses and mails them on your behalf. 58.5/100 — At Risk.

A site claiming 99.99% uptime that three separate Lighthouse runs could not measure, because the page never stops responding long enough to be measured. 53.5/100 — At Risk.

Three legal documents that agree with each other on a four-day deletion window, and no way to email anyone about them. 60/100 — Fragile.

80% accuracy, 40% YTD, 20 years of backtesting from a firm that says it has six years of experience — and no risk disclosure, terms or privacy policy anywhere on the site. 40/100 — At Risk.

A compliance-first e-invoicing platform that gives three different answers for how many jurisdictions it covers — 16, 18 and 30+ — on a single page. 56/100 — At Risk.

The highest score in this batch, from a budgeting app that connects bank accounts through Plaid and ships zero security headers — and whose terms are governed by the laws of an unnamed jurisdiction. 63.5/100 — Fragile.

The domain says moneymakerbet. The page says CoachMaker. The copyright says 2023. It takes €349 a year. 33/100 — Broken.

The best legal surface in the batch — risk disclaimer, ABN, named governing law — on a domain with no MX record, where support runs through a Gmail address published ten times. 63/100 — Fragile.

Paying customers, a complete trust surface, and onboarding that works without a card. 69/100 — Fragile, held back by a 19-second first paint.

A payments platform claiming SOC 2 Type II, PCI DSS Level 1 and ISO 27001, with a 26-second largest contentful paint and no DMARC. 48/100 — At Risk.

An AI ad-creative tool listed at half a million dollars with no revenue and 27 offers. 41.5/100 — At Risk. The legal documents live on a different domain, and the free trial charges you a dollar.

A perfect 100 on performance, a 100 on best practices, and not one line of legal text on a product that asks you to tell it everything you're subscribed to. 52/100 — At Risk.

An active product with paying customers and a massive security issue 36.5/100 — Broken. An anonymous visitor can read customer records and secret keys straight from the database — reported privately, and the operator declined to fix it.

A subscription tracker asking for your financial data, scored from the outside. 29/100 — Broken. Manual entry as the only way in, contact addresses that bounce or reach a stranger, a template placeholder live in the privacy policy, and a backend that stopped resolving.