Vibecode Rescue: sceneroll.com

sceneroll.com turns a voice memo into a vertical video — transcription, scene matching, B-roll, export. It earns $230 a month, the asking price is $25,000, and fourteen people have made offers.

It scored 69 out of 100. Fragile.

Observed on 2026-08-04 against a snapshot of the page, the shipped bundle, response headers, DNS and the legal pages. Signup and first use were walked through on a real account.

Onboarding is the reference implementation for this cohort

Email and password. A checkbox that reads "I agree to the Terms of Service and Privacy Policy", with both linked at the point of consent rather than buried in a footer. A confirmation email that arrives, says what it is, and expires in an hour. Then the app, with five credits already in the account.

No card required. The free tier is real: upload, transcribe, edit, preview, and one credit buys a minute of exported video.

That is the whole of A1, and it scores 13 of 15. A product that lets you reach its output before asking for money has solved the hardest part of its own funnel.

The profile page then does something almost nothing in this cohort does:

Delete Account — Permanently delete your account, projects, recordings, and uploaded media.

Self-serve, in the interface, not an email address you have to write to and hope. The privacy policy backs it with a stated retention period and a deletion timeline, which is more than most real companies manage.

Nineteen seconds to first paint

Which makes the performance number the strange part.

performance      63        LCP           19573 ms
accessibility    93        page weight   10258 KB
best practices   79        requests         78
SEO              92        3rd-party        11

19.6 seconds to largest contentful paint on mobile, against 10.3 MB transferred. A phone visitor on anything less than good wifi is looking at an unfinished page for most of a minute.

For a product whose funnel otherwise works — clear pricing, no card, credits granted immediately — this is the single most expensive line in the audit. The onboarding is good enough that the load time is the highest-return fix on the whole property.

Accessibility is 93 with three failures: sixteen elements below contrast, one link with no discernible name, and one visible label that does not match its accessible name.

What the trust surface has, and what it doesn't

Terms and privacy are both real documents, dated April 2, 2026, naming an entity, with a retention period, a deletion path, a deletion timeline and a refund policy. The policy names Stripe and Supabase as processors. Neither was observed loading on the public page, which is expected — they run server-side and post-auth — and is not a defect.

Four things are missing: a stated jurisdiction, a security contact, a cancellation description, and any contact address at all in the legal pages. For a product taking money every month, a terms document with no way to contact anyone is the gap I would close first.

Mail is configured with SPF, but DMARC sits at p=none — monitor-only, blocking nothing.

Engineering

Security headers are strong: HSTS with includeSubDomains and preload, X-Frame-Options: DENY, nosniff, a real Referrer-Policy and a Permissions-Policy that scopes camera and microphone to self and turns payment off. Only CSP is absent.

Seventy-eight requests, zero direct-to-database calls on the public page. Supabase is named in the policy but the browser never talks to it directly, so the failure mode that stack is known for is architecturally excluded here.

The credential scan is clean across nine classes.

One real defect: a request for a path that does not exist returns HTTP 200 with the app shell, and the page never says "not found". Search engines index those as duplicates and a user who mistypes a URL gets no explanation.

A short public record

The web archive holds two captures of sceneroll.com, the first from 2026-05-19 — roughly two months of public history.

That is not a defect. It is a limit on what this audit can say: claims about traction, longevity or usage cannot be corroborated from outside, because there is almost nothing outside to corroborate them against. Everything scored here is what the product does today.

The score

What I'd fix first

1. The 19.6-second LCP. 10.3 MB on a mobile-first product is the one number costing real money.
2. Publish a contact address in the terms and privacy policy.
3. Return a real 404 instead of a 200 with the app shell.
4. Move DMARC off p=none, and add a security contact.
5. State the jurisdiction and describe cancellation, both one paragraph each.

Disclosure

Findings went to the operator before this published. These audits are free and public; the paid version is a Code Health Check, and the rescue work after it is Track 03 on my services page.