Vibecode Rescue: financhle.com

Financhle is an options-flow and market research site with games attached. You can watch unusual options activity, browse ETF holdings and earnings calendars, and play a daily guess-the-S&P-500-company puzzle. Pro is $29 a month against competitors it says charge $100+, with a 7-day no-questions refund written into the terms.

It scored 53.5 out of 100. At Risk.

Observed on 2026-08-05 against a snapshot of the page, the shipped bundle, response headers, DNS and the legal pages. No account was created.

The page never stops

This is the finding, and it took three failed measurements to be sure of it.

$ curl -o /dev/null -sw 'ttfb=%{time_starttransfer}s  total=%{time_total}s  %{size_download}b\n' \
    https://financhle.com/
ttfb=0.204s  total=0.297s  96410b

The server is fast. The HTML is 96 KB and arrives in a third of a second, three times running. Then you put a browser on it:

$ time google-chrome --headless --virtual-time-budget=15000 --dump-dom https://financhle.com/
  chrome dump-dom: 79.06s

Seventy-nine seconds to produce a stable DOM. And Lighthouse simply refuses:

Lighthouse 7  (full run)                → "the page stopped responding"
Lighthouse 12 (full run)                → "the page stopped responding"
Lighthouse 12 (accessibility only,      → "the page stopped responding"
               max-wait-for-load 60s)

Three runs, two engine versions, one accessibility-only pass with the timeout raised to a minute. All three gave up. That is not a flaky network or a cold cache — it's a page that never reaches a quiet moment, which is what you'd expect from live market data polling on an interval with nothing throttling it.

Now put that next to the homepage:

Trusted by institutions & retail traders alike

10,000+ Active Users · 50B+ Trades Analyzed · 99.99% Uptime

Uptime and responsiveness are different measurements, and I want to be fair about that: the server is up, and it answers in 200 ms. But 99.99% uptime is being offered as a reassurance about reliability, on a page that three standard measuring tools cannot hold still long enough to score. The number is technically about one thing and rhetorically about another, and the rhetorical claim is the one this page can't support.

A note on method, because it changes what I'm allowed to publish. The automated accessibility checks did not complete here, for the same reason. Under my own rules that's Unmeasured, not Unknown, and Unmeasured normally blocks the band — you don't get a total when a check wasn't run. I've scored B6 anyway, at 1 of 6, on the delivery and performance evidence above, because the check was run, three times, and the product defeated it. The distinction matters: nobody skipped this. I'm flagging it rather than burying it, because the alternative reading — that I quietly counted a failed measurement as a bad one — is exactly the substitution this rubric exists to catch.

The claim stack

Four sets of numbers appear on the homepage, and they don't quite belong to each other:

hero            10M+ Options Tracked Daily
                16K+ Public Companies Covered
                10K+ Active Users

trust strip     10,000+ Active Users
                50B+ Trades Analyzed
                99.99% Uptime

Pro section     Join hundreds of traders already using Financhle Pro

Ten thousand active users and "hundreds" of Pro subscribers aren't a contradiction — that's a perfectly normal free-to-paid ratio, and I'd rather see it stated than hidden. What I can't check is any of the rest, and neither can a buyer. "50B+ Trades Analyzed" and "99.99% Uptime" are the two that would need a dashboard behind them, and neither is linked to one.

The privacy policy came out of a generator, and left the label on

The policy is thorough in the way generated policies are thorough — every section present, none of them specific. It also ships this, in the body text:

You can learn more about cookies on TermsFeed…

That's the generator's own name, sitting in the document. It doesn't make the policy invalid, and I've seen far worse: the retention section exists, the deletion right is stated, the categories are enumerated. But the retention promise is "as long as is necessary for the purposes set out in this Privacy Policy" with no period attached to any data class, which is the boilerplate answer to the one question a user is actually asking.

The terms, by contrast, do real work. A 7-day full refund, granted on request without argument. And this, which several products in this batch should copy:

Financhle is not a registered investment advisor, broker-dealer, or financial institution. We do not provide personalized investment advice.

The browser talks to the database

https://mabelbpvvtwwnsgdgjck.supabase.co
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…    (×2 in the bundle)

Supabase project URL and anon key in the shipped bundle. Public by design; the protection is row-level security, and whether it's enabled and complete is invisible from outside. B2 is Unknown, exactly half of eleven, and it stays there until someone with repository access looks.

While scanning for it I hit three matches for BEGIN RSA PRIVATE KEY and BEGIN EC PRIVATE KEY in the bundle, which is the kind of thing that makes you sit up. They're false positives — a crypto library's PEM parser, with the literal header strings in its code and zero actual key bodies anywhere in the file. Worth writing down because the scanner found them and a careless auditor would have published them.

What it gets right

• Three of six security headers: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a Referrer-Policy. HSTS, CSP and Permissions-Policy are missing.
• SPF is published with two includes, and MX resolves through Cloudflare, so hello@financhle.com — published three times — actually receives mail.
• The free tier is real and immediate. The daily puzzle and the SPY prediction game are playable, and the market overview, ETF holdings and earnings calendar are readable without an account. That's a genuine reason to come back tomorrow, which is more than most products in this batch have.
• A path that doesn't exist returns a real 404.
• Pricing is honest about the comparison: $29 against "competitors at $100+/month" is a specific, falsifiable claim rather than a vague one.
• The refund policy is stated in the terms, not just the marketing.

The engineering underneath

DMARC is absent. SPF alone doesn't tell a receiver what to do with mail that fails.

The sitemap.xml is 699 bytes — for a site with per-ticker pages, an IPO directory, an earnings calendar, a news section and an "All Tickers" route. The robots.txt is 3.1 KB, four times the size of the sitemap it points at. Whatever is generating that sitemap is not seeing most of the site, and A5 is scored on that gap rather than on any intent.

The score

What I'd fix first

1. Find out why the page never idles. A polling interval with no backoff, a websocket reconnect loop, or an animation that never settles — whatever it is, it's costing you real users on real laptops, and it's why nothing can measure you. Start with the tab's CPU after 60 seconds of sitting still.
2. Drop the 99.99% uptime line until there's a status page behind it. Replace it with the numbers you can prove.
3. Fix the sitemap. Six hundred and ninety-nine bytes is not a sitemap for this site, and organic discovery is the cheapest channel a research product has.
4. Publish DMARC, and add HSTS.
5. Put a retention period in the privacy policy — actual durations per data class. It's the section users read and the section generators leave empty.

Disclosure

Findings went to the operator before this published. These audits are free and public; the paid version is a Code Health Check, and the rescue work after it is Track 03 on my services page.

Two dimensions scored Unknown and code access resolves both: whether row policies are enforced on the tables the browser is already querying, and how subscription state is reconciled with the payment processor.