Vibecode Rescue: refinequant.com

RefineQuant turns a sentence into a backtest. You describe a setup in plain language — the example prompt on their own homepage reads:

Build a liquidity sweep reversal strategy with retest entries,
a 1:2 RR target, and no trades on red folder days.

It converts that into explicit entry, exit and risk rules, runs them against historical bars, and shows you win rate, drawdown and trade count before you change anything. It's in public beta, currently on GOLD/XAUUSD, and the free tier comes with gifted AI credits.

It scored 63 out of 100. Fragile.

Observed on 2026-08-05 against a snapshot of the page, the shipped bundle, response headers, DNS and the full legal surface. No account was created.

The paid tiers can't be bought

The pricing table renders four columns — Free, Starter $9, Pro $29, Elite $79 — with a complete feature matrix underneath: AI credits per month, active strategy counts, historical bar limits, email and SMS alert quotas, deep testing and optimisation allowances.

Three of the four columns say this where the button should be:

Not available

Starter, Pro and Elite. Prices shown, features enumerated, purchase impossible.

I want to be careful here, because there's a reading where this is correct behaviour: it's a public beta, the team hasn't switched on billing, and rather than take money for something unfinished they've disabled the tiers. That's the honest version, and given everything else on this site I think it's the true one.

It's still a seam, for a boring reason. A price with a dead button is the single most expensive thing you can put in front of someone who was ready to pay, and nothing on the table explains it. A "billing opens in September", a waitlist link or a strikethrough would each do the job; the table offers none of them. The FAQ underneath asks "What plans are available right now?" and the pricing table above it has already answered with three shrugs.

The screenshots show a backtest that never ran

The marketing UI carries a results panel:

Win Rate 68.4%    Sharpe / Risk 2.18    Max Drawdown -3.8%
Trades 126        Profit Factor 2.34    Expectancy +$13,421

Further down the page, the same panel appears again, zeroed:

Win Rate 0.0%     Sharpe / Risk 0.00    Max Drawdown 0.0%
Trades 0          Profit Factor 0.00    Expectancy +$0

The second instance is the tell: these are component states, not results. The populated one is illustrative furniture, chosen by whoever built the section.

On most products that's unremarkable — every SaaS homepage has a fake dashboard. On a backtesting product for retail traders, the illustrative numbers are the product's output, and 68.4% with a 2.18 Sharpe and a $13,421 expectancy is a very good strategy. A visitor has no way to know that panel isn't a real result from the tool, and the site never labels it. The footer does the work the screenshot should: "General information only — not financial advice. Backtests are simulated."

The legal surface is the best in the batch, and the mailbox doesn't exist

Start with what's right, because there's a lot of it. Linked in the footer, all real, all reachable: Terms, Privacy, Risk Disclaimer, Refunds, Cookies, Acceptable Use. The privacy policy names a retention posture and discards visitor-session identification after 24 hours. And this:

ABN 37 104 727 887 · Australia

Governing law: Australia

Support: 9:00 AM – 5:00 PM Oceania business hours (AEST/AEDT)

A registered business number, a named jurisdiction, stated support hours. Two other products in this batch publish thorough policies and never say who or where they are; this one leads with it.

Then the DNS:

$ dig +short refinequant.com MX
                                    # nothing

$ dig +short refinequant.com TXT | grep spf
                                    # nothing

$ dig +short _dmarc.refinequant.com TXT
"v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:dmarc_rua@onsecureserver.net;"

No MX record at all. Any address at @refinequant.com — support@, legal@, privacy@, anything a user might reasonably try after reading those policies — bounces. And the DMARC record is p=quarantine, the strongest policy in this batch, published for a domain that cannot receive mail.

The published contact is a personal Gmail:

=== EMAIL ADDRESSES PUBLISHED ===
     10  refinequant@gmail.com

Ten times, including inside the Privacy policy and the Terms — the two documents whose entire purpose is to give a person a route to exercise a right. The route is a free consumer mailbox: unretained, undelegated, and unconnected to the ABN the same page is careful to publish.

Nothing about this is dishonest, which is what makes it a good example. Somebody did the hard part, then skipped the twenty minutes it takes to add MX records and a support@ alias. They registered the business, wrote six real policies, named the governing law and set a strict DMARC policy. The careful work is undermined by the one step that isn't lawyer-shaped.

What it gets right

• The most complete legal surface in the batch. Six documents, all linked, all real, plus a risk disclaimer and an acceptable-use policy that most competitors don't bother with.
• Honest scope language throughout. "See the current public beta scope", "Backtests are simulated", "General information only — not financial advice", and an FAQ that answers "Is every route on the site fully available?" instead of pretending everything is.
• A clean credential scan — 8.5 of 10 on Secrets, the highest in this batch. Nothing exposed in the bundle.
• No client-to-database calls on the public surface. Four of the ten products here ship a Supabase anon key with a browser-to-database shape; this one doesn't, which is why B2 scores Inferred at 8 of 11 rather than Unknown at 5.5.
• Third-party attribution is correct: TradingView Lightweight Charts credited with its copyright notice, as the licence requires.
• HSTS is set, a path that doesn't exist returns a real 404, and Lighthouse accessibility comes back at 96.
• DMARC at p=quarantine — nobody else in this batch is above p=none.

The engineering underneath

Five of six headers missing; HSTS alone is present. No CSP.

Lighthouse 12, desktop: performance 77, accessibility 96, best practices 74, SEO 100. 2.0 MB transferred, 1.5-second largest contentful paint, 361 ms blocking. The best-practices score is the soft spot — 74 on a page this light usually means console errors and deprecated APIs rather than anything structural.

The score

Part B at 28.5 of 45 is the highest engineering score in this batch. This is a product whose problems are all in the last mile.

What I'd fix first

1. Add MX records and a support@ alias. Your policies point users at an address; make the domain able to receive it. Twenty minutes, and it's the highest-leverage item on this list.
2. Explain the disabled tiers. "Billing opens when the beta closes — join the list" turns three dead buttons into three captured emails.
3. Label the sample backtest. One line under the panel — "illustrative, not a result" — closes the only place where this otherwise careful site could mislead someone about performance.
4. Move support off Gmail once the mailbox exists, and update the two policies that cite it.
5. Add a CSP, and chase the best-practices score down to its cause.

Disclosure

Findings went to the operator before this published. These audits are free and public; the paid version is a Code Health Check, and the rescue work after it is Track 03 on my services page.

Payments scored Unknown: the privacy policy describes webhook billing fulfilment, disputes and refunds, and none of that is observable from outside while the paid tiers are switched off.