Vibecode Rescue: basedlabs.ai

basedlabs.ai is an AI creative platform — image and video generation, founded in 2023. It reports no revenue. The asking price is $2,180,000, the highest zero-revenue ask in the corpus, and seven people have made offers.

It scored 47 out of 100. At Risk.

Observed on 2026-08-04 against a snapshot of the page, the shipped bundle, response headers, DNS and the legal pages.

Nobody can create an account

$ curl -o /dev/null -w '%{http_code}\n' https://basedlabs.ai/signup
404
$ curl -o /dev/null -w '%{http_code}\n' https://basedlabs.ai/login
404

Both, plus /register and /sign-up, return a real 404 — not a soft one, an actual 404 page. I checked six plausible auth subdomains (app, dashboard, my, account, auth, portal); every one returns Cloudflare 525, an SSL handshake failure, including names I invented, which is the signature of a wildcard rather than a service.

A wildcard means I cannot prove no account system exists somewhere. What I can say is the narrower and more useful thing: there is no path from the public site to creating an account. A visitor who wants to use this product cannot.

That is A1, and it scores 1 of 15.

The pricing page works fine. You can read what the tiers cost. You cannot buy one.

The terms of service are thorough

This is where the listing's own framing had it backwards, and mine did too until I read the file.

/terms-of-service is a 49,226-character document. It names a legal entity, states a jurisdiction, sets out a retention period, describes a deletion path, explains cancellation, and carries a refund policy. andrew@basedlabs.ai appears five times and the domain has working mail.

That is a more complete commercial surface than a lot of funded companies put out.

Then:

$ curl -o /dev/null -w '%{http_code}\n' https://basedlabs.ai/privacy
404
$ curl -o /dev/null -w '%{http_code}\n' https://basedlabs.ai/privacy-policy
404

There is no privacy policy. A product built to ingest user prompts and generated media, asking two million dollars, has fifty thousand characters of terms and no privacy policy at all.

The pairing is the interesting part. This is not carelessness across the board — somebody sat down and did the terms properly. The privacy policy is a specific, isolated absence.

Also missing: a last-updated date on anything, a deletion timeline, and a security contact. The domain publishes SPF but no DMARC, so @basedlabs.ai is spoofable.

The interface fails eight accessibility audits

Mobile Lighthouse accessibility comes in at 73, with eight distinct failures:

aria-allowed-attr       25 elements    aria-* attributes don't match their roles
button-name              7 elements    buttons with no accessible name
color-contrast          12 elements
image-redundant-alt      4 elements
link-name                4 elements
meta-viewport            1 element     user-scalable="no"
target-size            106 elements    touch targets too small or too close

user-scalable="no" disables pinch zoom. On a visual product, on a phone, that one is a choice somebody made.

106 elements with inadequate touch targets is not a rounding error either — that is the interface, on the device most people would use it from.

Performance is 32, across 247 requests.

What it gets right

• Five of six security headers — HSTS at two years, X-Frame-Options: SAMEORIGIN, nosniff, a real Referrer-Policy, and a Permissions-Policy that turns off camera, microphone, geolocation and interest-cohort. Only CSP is absent.
• A real 404 that names the problem and leaks no framework detail.
• Clean credential scan across nine classes, with no placeholders or builder artifacts.
• Stripe is loaded and named, so payments run through a known processor.
• 465 KB of server-rendered HTML on the root — this is a real application, not a landing page with a waitlist. Thirty-one archive captures back to 2023-12-22 corroborate the founding date.
• Zero direct-to-database calls from the browser.

The shape of it

A real application, built over two years, with a thorough terms of service and a working contact address. Against that: a missing privacy policy, an unreachable signup, and an interface failing eight accessibility audits.

The pattern is a product that got the hard, boring parts of the commercial surface right and then stopped short of the parts a user actually touches. The signup route is probably an afternoon's work. Until it exists, every other improvement lands on a product nobody new can use.

The score

What I'd fix first

1. Restore signup and login. Everything else is secondary to a product nobody can join.
2. Write a privacy policy. The terms show it can be done properly.
3. Remove user-scalable="no" and fix the 106 touch targets.
4. Publish DMARC — SPF alone leaves the domain spoofable.
5. Add a last-updated date and a security contact.

Disclosure

Findings went to the operator before this published, at the address the terms publish. These audits are free and public; the paid version is a Code Health Check, and the rescue work after it is Track 03 on my services page.