Vibecode Rescue: aimytrade.io

aimytrade.io is an AI trading product. It earns $192 a month from paying customers, the asking price is $30,000, and eight people have made offers.\n\nSignup was walked through on a real account.

It scored 56.5 out of 100. At Risk.

Observed on 2026-08-04 against a snapshot of the page, the shipped bundle, response headers, DNS and the legal pages.

Signup exists, but not where anyone looks for it

The conventional routes are all gone:

$ for p in /login /signup /register /sign-up; do
>   curl -o /dev/null -w "$p %{http_code}\n" -L https://aimytrade.io$p
> done
/login 404
/signup 404
/register 404
/sign-up 404

Registration is reachable — it lives behind /pricing, which requires an account before you can go further. The product has a front door; it just isn't at any of the four addresses a person or a crawler would try, and nothing links those addresses to the real one.

Anyone arriving with intent to subscribe — from a link, a search result, an old bookmark — hits a 404 and leaves, and the product never learns it happened. On a subscription business earning $192 a month, the gap between having a signup and having it where people look is most of the funnel.

A1 scores 6 of 15: the path exists, it is undiscoverable at convention, and value sits behind registration.

The legal documents are real

Both of them:

$ curl -o /dev/null -w '%{http_code} %{size_download}\n' https://aimytrade.io/terms
200 66680
$ curl -o /dev/null -w '%{http_code} %{size_download}\n' https://aimytrade.io/privacy
200 69367

They name an entity, state a jurisdiction, set a retention period, describe a deletion path with a timeline, and explain cancellation. A separate /refund-policy exists too.

What they lack is a last-updated date on any of them, a stated set of data-subject rights, and a security contact. On a fintech the security contact is the one I would add first, because a researcher with a finding currently has nowhere to send it.

What it gets right

• A light page. 1.4 MB across 87 requests, with a 4.1-second largest contentful paint on mobile.
• Five of six security headers: HSTS with includeSubDomains, X-Frame-Options: SAMEORIGIN, nosniff, Referrer-Policy, and a Permissions-Policy that disables camera, microphone, geolocation and interest-cohort. CSP is the gap.
• SPF ends in -all — a hard fail, the strict form, which almost nothing in this cohort bothers with.
• A real 404 that names the problem and leaks nothing, served consistently on every unmatched route.
• Zero direct-to-database calls from the browser across 87 requests.
• Clean credential scan across nine classes.
• Accessibility 91, with three failures.

The mail and header hygiene here is real work. Somebody configured this carefully, which makes the missing login route stranger rather than less strange.

Where it thins out

DMARC is absent. SPF is strict, and then nothing enforces it, so @aimytrade.io can be spoofed — on a fintech, where a convincing spoofed email is the whole attack.

Twenty-one third-party origins load on the marketing page, and SEO scores 73.

The web archive holds three captures, from 2025-09-21 to 2025-11-20. Nothing since — roughly eight months with no public record for a product currently taking subscriptions.

The score

Part B comes to 29 of 45. The engineering is the least of this product's problems.

What I'd fix first

1. Put signup and login at /signup and /login. The registration flow exists; it is one redirect from being findable.
2. Add a /security route or a security.txt. That URL 404s today, on a fintech.
3. Publish DMARC. Strict SPF with nothing enforcing it is half a control.
4. Add a security contact — a security.txt is twenty minutes.
5. Date the legal documents.

Disclosure

Findings went to the operator before this published. These audits are free and public; the paid version is a Code Health Check, and the rescue work after it is Track 03 on my services page.