Vibecode Rescue: moneko.io

Moneko is an AI budgeting app you drive from chat. Text it "Coffee 4.50", send it a receipt photo or a voice note on WhatsApp, forward it a PDF statement, and it turns the message into a reviewable transaction. Underneath sits envelope budgeting — Pockets — plus household mode for shared bills, net worth tracking across manual and Plaid-connected accounts, and scenario planning that answers "can I buy a $2,000 laptop before January?".

It scored 63.5 out of 100. Fragile — the highest in this batch of ten.

Observed on 2026-08-05 against a snapshot of the page, the shipped bundle, response headers, DNS and the legal pages. The apps themselves are store builds and were not installed; anything behind the login is a Human-check item, not a score.

Six security headers, all missing

=== SECURITY HEADERS ===
  MISSING  strict-transport-security
  MISSING  content-security-policy
  MISSING  x-frame-options
  MISSING  x-content-type-options
  MISSING  referrer-policy
  MISSING  permissions-policy
  server: cloudflare

Every one. Not a partial set with HSTS carrying the load — nothing.

On a marketing page that would be a hygiene item worth two lines. This product connects US and Canadian bank accounts through Plaid, ingests salary, rent, credit card balances and net worth, and accepts forwarded email receipts at files@inbound.moneko.io. The data class is financial, and the severity bar moves with the data class even though the weights don't.

HSTS is the one I'd argue about first: without it, the first request of a session over http:// is available to be intercepted before the redirect. The rest are cheap — X-Content-Type-Options: nosniff and X-Frame-Options: DENY are one line each in a Cloudflare Transform Rule, and the product is already behind Cloudflare.

Governed by the laws of somewhere

From the Terms of Service, section 12, in full:

Governing Law. These Terms of Service shall be governed by and construed in accordance with the laws of the jurisdiction in which Moneko operates, without regard to its conflict of law provisions.

Which jurisdiction is that? The site doesn't say. The site and both policies leave the company name, the registered address, the incorporation detail and the country blank. The clause is a variable that was never bound.

A governing-law clause exists to answer one question — whose courts, whose consumer law — and this one answers it with a lookup that has no source. If a user in Malaysia (and from the App Store reviews, plenty are) needed to enforce a term, the document tells them to find out where Moneko operates first, and gives them no way to do it.

That's the second product in this batch to publish thorough policies while declining to name the entity behind them. It's becoming the pattern I'd flag to anyone doing diligence on a product built this way: the generated document covers the sections a policy should have, and leaves the identity — the one thing a generator cannot invent for you — as a blank that nobody filled.

The deletion promise, and its blast radius

Most audits in this series find marketing that overstates what the policy allows. This one is the reverse, and it's worth the space.

Homepage:

One-Click Wipe. If you decide to leave, you can delete your account and all associated data instantly. We keep no backups. When you say go, it's gone for good.

Privacy policy, section 6:

Deletion of all personal information and financial data. No backup copies retained by Moneko. Irreversible deletion — once deleted, data cannot be recovered. We implement true deletion, not just deactivation.

Terms of service, section 6:

You can delete your account and all associated data with one click. We do not keep backup copies of deleted user data.

Three documents, one claim, stated identically. That's a coherence positive, and it's rare enough in this series that I want to name it — the marketing page and the legal page were written by people who talked to each other.

Two things to sit with anyway. First, the scope quietly narrows between the homepage and the policies: "We keep no backups" reads as a statement about the whole system; "no backup copies of deleted user data" is a much more specific and much more sensible promise. Both are on the site, and the looser one is in the bigger typeface. Second, if the literal reading is ever true — no backups anywhere — that's a durability posture, not a privacy feature, and it's the kind of thing that ends an app when a migration goes wrong. B5 is scored with that in mind: the promise is good for users and a question for operations.

Fifteen and a half megabytes

Lighthouse 12, desktop:

performance     72
accessibility   85
best practices 100
SEO             92

largest contentful paint   1.5 s
total blocking time       306 ms
transferred               15.5 MB

The paint is fine and the best-practices score is a clean 100 — the weight is the story. 15.5 MB is the heaviest page in this batch by 50%, on a product whose whole pitch is that it works from WhatsApp on your phone while you're standing at a till. Someone on a metered connection in Malaysia — again, where a good share of the reviews come from — pays for that page.

Accessibility at 85 has failures that read like a marketing page grown organically: image-alt, image-redundant-alt, heading-order, aria-prohibited-attr and contrast.

What it gets right

• Time-to-value is the best in the batch, and 12 of 15 is the highest A1 I've given. Free to start, no card, apps live in both stores, and a product summary section that explains what every screen does before you install anything.
• The App Store evidence is specific: 4.8/5, "116+ public store reviews tracked", with named reviewers, countries and dates quoted on the page. Verifiable in a way that "trusted by thousands" never is.
• Discoverability is strong — a 54 KB sitemap, a real robots.txt, an extensive FAQ and comparison content, SEO 92.
• A clean credential scan across nine classes. Nothing exposed in the bundle.
• SPF is published (Google plus Amazon SES) and MX resolves, so the inbound receipt address works.
• The comparison tables name real competitors — YNAB, Monarch, Copilot, Quicken Simplifi — and describe their behaviour fairly rather than building strawmen.
• A path that doesn't exist returns a real 404.

The engineering underneath

DMARC is p=none: monitor-only, and it blocks nothing. For a product that accepts inbound email attachments from approved sender addresses and turns them into financial records, the sending domain being spoofable is a more interesting problem than usual. The approved-sender list is the control, and the whole point of DMARC is to make "this really came from that sender" mean something.

The score

Part A is 39 of 55, the strongest product-and-growth score in this batch. Part B is 24.5 of 45. Fragile is the right word for it: this works today, people like it, and the things that would hurt it are all a growth spurt away.

What I'd fix first

1. Set the six headers. Start with HSTS and nosniff. You're on Cloudflare; this is a Transform Rule and an afternoon.
2. Name the jurisdiction, and the entity. "Governed by the laws of the jurisdiction in which Moneko operates" is not a governing-law clause, and a user cannot act on it.
3. Get the page under 5 MB. Fifteen and a half is a decision somewhere in the asset pipeline, and your users are on phones on mobile data by design.
4. Move DMARC to quarantine. You accept financial documents by email from approved senders; make the sender check mean something.
5. Reconcile the two versions of the backups claim. Say "we keep no backups of deleted data" on the homepage too — it's still a strong promise and it's the one you can keep.

Disclosure

Findings went to the operator before this published. These audits are free and public; the paid version is a Code Health Check, and the rescue work after it is Track 03 on my services page.

Data Access scored Inferred rather than Confirmed: no client-to-database calls are visible on the public surface, which is the shape you want on a product holding bank data — but the mobile apps were not installed, and what they talk to is a Human-check item this tier doesn't cover.