Vibecode Rescue: moneymakerbet.com

You load moneymakerbet.com and the browser tab says CoachMaker. So does the logo, the copy, the footer and the copyright notice. The product is a French sports-betting tips subscription: pay for a pack, get a daily tip with analysis, receive it by Telegram. One month is €29.99 for 30 tips, two months €89.99 for 70, a year €349. Payment by card, by PCS voucher, or in crypto.

It scored 33 out of 100. Broken.

Observed on 2026-08-05 against a snapshot of the page, the shipped bundle, response headers, DNS and the rendered application. The tips themselves sit behind a paywall, which is where I stopped.

The domain and the product are different brands

$ curl -s https://www.moneymakerbet.com/ | grep -i '<title>'
    <title>CoachMaker</title>

Not a redirect. Not a holding page. The Angular application served at this domain is CoachMaker, top to bottom, and the string "moneymakerbet" appears nowhere in the rendered page — not in the copy, not in the footer, not in the terms link, not in the logo.

There are innocent explanations. A rebrand that never finished; a second domain bought for search or for a market and pointed at the same app; an acquisition where the name came with the code. Every one of those is plausible, and none of them is stated anywhere a visitor can see.

Here's why it isn't cosmetic. Somebody arrives on a domain they were sent to, lands on a brand they've never heard of, and is asked for €349 and a payment method that includes prepaid vouchers and crypto — two rails with no chargeback. The mismatch is the first trust signal a careful buyer checks, and it fails before the pricing table loads.

The copyright is three years stale

Copyright © 2023, CoachMaker - tous droits réservés | CGU / CGV

Both footer variants — desktop and mobile — say 2023. The product is live now and taking annual subscriptions that run into 2027.

A stale copyright year on a brochure site is nothing. On a live paid product it's a date stamp on the last time anyone edited the shell, and it sits directly beside the links to the CGU and CGV — the contract documents. If the footer hasn't been touched since 2023, the reasonable question is when the terms it links to were last reviewed.

Every URL returns 200, including the ones that shouldn't exist

$ curl -o /dev/null -sw '%{http_code}\n' https://www.moneymakerbet.com/seams-audit-does-not-exist
200

$ curl -o /dev/null -sw '%{http_code}\n' https://www.moneymakerbet.com/robots.txt
200
$ curl -s https://www.moneymakerbet.com/robots.txt | head -1
<!doctype html>

The Angular router answers everything with the app shell, so a path nobody has ever created comes back 200. robots.txt and sitemap.xml do too — meaning this site has neither, but every automated check for them passes. A crawler asking for the robots file receives an HTML document and has to decide what to do with it.

That's the pattern across three of the ten products in this batch, and it's the single most reliable tell of the client-rendered stack: the server stopped having opinions about URLs, so every question gets the same answer.

The Stripe keys in the page

Inline in index.html, two of them:

// var stripe = Stripe('pk_live_ULD8jns3NWNQ6a7dt1Kn5ld7…
   var stripe = Stripe('pk_live_51IfV42LwiS5VbnIXVVNgUEiY3ixel4Ek…

These are publishable keys. They're meant to be in the page — that's the entire point of the publishable/secret split, and finding one is not a leak. I'm noting them because of the first line: an older live key, commented out, shipped to production directly above the current one.

That's a small thing that tells you something real about the deploy path. Nobody removed the dead line; they commented it and pushed. It's the same habit that leaves a template placeholder in a footer, and it's the habit that eventually ships the key that isn't publishable.

What it gets right

Genuinely, and it's the part I didn't expect:

• The gambling harm-reduction notices are specific and correct. Minors prohibited, play within your means, and a real explanation of interdiction volontaire de jeu — that a self-exclusion request goes to the ministère de l'intérieur, that it covers casinos, gaming circles and licensed online sites, and that it runs three years without possibility of reduction, citing loi n° 2010-476 of 12 May 2010. That's a correct legal reference, and it is more regulatory care than several products in this batch show about anything.
• CGU and CGV are both linked, along with privacy preferences.
• SPF is published (OVH plus Mandrill), so the sending domain is protected against the basic forgery.
• Google MX records resolve, so the published contact route receives mail.
• The packs are stated plainly — price, tip count and duration, with "Sans engagement" under every tier. Nothing here is a trial that quietly renews.

The engineering underneath

All six security headers are missing.

DMARC is absent entirely.

Lighthouse 12, desktop: performance 38, accessibility 80, best practices 74, SEO 75. 3.8 MB transferred, a 5-second largest contentful paint and 776 ms of total blocking time — for a page whose visible content is a login box and three price cards.

Accessibility failures include link-name and listitem, so links without discernible names and list items outside a list, on a page where the primary action is a link.

The claim I can't test, and won't pretend to

The value proposition is stated as a ladder:

Meilleur est le pack, meilleur est le conseil. (The better the pack, the better the tip.)

Pay more, get better advice. Everything a subscriber would use to test that claim — a record of past tips, a win rate, a history — is absent, before paying and after. I'm not scoring the betting outcomes; that's not what this rubric measures and I have no way to observe them. I'm scoring the fact that a product charging €349 a year publishes nothing a customer could use to evaluate it, and structures its pricing so that the quality of the thing you bought is only knowable by buying more of it.

The score

Coherence scores 1 of 8. When the domain, the brand and the copyright year are three different answers, there isn't much left to be coherent about.

What I'd fix first

1. Reconcile the domain and the brand. Either redirect moneymakerbet.com to the CoachMaker domain, or say on the page why both exist. Right now the first thing a visitor learns is that something doesn't line up.
2. Update the copyright and re-date the CGU/CGV. If the terms are current, say so with a date; if they're from 2023, that's the more urgent finding.
3. Serve a real robots.txt and sitemap.xml, and return 404 for paths that don't exist. Everything about being findable starts there, and SEO is scoring 75 on a product that needs traffic.
4. Delete the commented-out Stripe key and add the six security headers.
5. Publish a tips record. Not because the rubric asks for it — because it's the only thing that would make the price defensible to a sceptic, and the sceptics are the customers you don't have yet.

Disclosure

Findings went to the operator before this published. These audits are free and public; the paid version is a Code Health Check, and the rescue work after it is Track 03 on my services page.

Data Access scored Inferred rather than Confirmed: the application is auth-gated and no client-to-database calls are visible on the public surface, which is the shape you want, but not proof of it.