Vibecode Rescue: zubly.app

Zubly tracks subscriptions. Every recurring service in one dashboard, currency-aware, with renewal and price-hike alerts and a view of what's duplicated or forgotten. The footer says Version 0.1.0, and the copy is refreshingly straight about that: "We are intentionally starting with subscription management to make it excellent."

It scored 52 out of 100. At Risk.

Observed on 2026-08-05 against a snapshot of the page, the shipped bundle, response headers, DNS and every legal route the site might have served. The apex redirects to www, which is where everything below was measured.

This is the smallest product in the batch, and it produces the cleanest version of the batch's most common failure.

The engineering is perfect and the paperwork is missing

Lighthouse 12, desktop:

performance    100
accessibility   96
best practices 100
SEO             91

largest contentful paint  0.6 s
total blocking time         2 ms
transferred               0.3 MB

A hundred on performance. A hundred on best practices. Ninety-six on accessibility, with one failure — target-size — and 0.3 MB over the wire. That is the best Lighthouse profile in this batch and one of the best I've measured in this series.

Now the legal surface:

$ for p in privacy privacy-policy terms terms-of-service; do
    curl -o /dev/null -sw "%{http_code}  /$p\n" https://www.zubly.app/$p
  done
404  /privacy
404  /privacy-policy
404  /terms
404  /terms-of-service

And a search of the rendered page for any href containing privacy, terms, legal or policy returns nothing. A privacy policy, terms of service, a cookie notice, a company name, an address, an email address — this site publishes none of them.

The product asks you to create a free account and then tell it every service you pay for, what you pay, in which currency, and when it renews. That list is a remarkably complete picture of a person: their software, their media, their gym, their therapy app, their dating apps, the newspaper they read. It's the kind of dataset that a breach makes very personal very fast, and there is not one sentence anywhere describing what happens to it.

The two things are the same story, told twice. Somebody who ships a 100/100 Lighthouse score is careful and knows what they're doing. The care went entirely into the part of the product that a developer can see is broken.

Version 0.1.0, in production, with a signup form

The version badge is in the footer, and I like that it's there — most products at this stage pretend to be further along. But it sits next to a working "Create Free Account" button, which puts the product in the category this rubric was built for: live, taking users, and not finished.

The rules of engagement for this series exclude waitlist pages, because a product nobody can use yet has no time-to-value to measure. Zubly isn't that. You can sign up right now, and the moment you can sign up, the absence of terms stops being a pre-launch detail and becomes a live one. There is no document saying what the service promises, what happens when it goes away, or who owns the list you just typed in.

A 0.1.0 that ships a privacy policy and a two-paragraph terms page would score materially higher here than a 1.0 that doesn't.

The site is three pages and no map

Beyond the homepage, only /pricing answers. No robots.txt at 200, no sitemap.xml, and SEO scores 91 largely on the strength of the page itself rather than anything pointing at it.

Lighthouse also flags the redirect: the tested URL https://zubly.app/ was redirected to https://www.zubly.app/. That's a normal apex-to-www setup and it costs a hop, not correctness — but it does mean the canonical decisions and the sitemap that would normally settle which host search engines index don't exist to settle it.

What it gets right

• The best delivery profile in the batch, described above.
• The copy is honest about scope. "Focused today, ambitious tomorrow", "We are intentionally starting with subscription management", "Your feedback guides the next set of insights and automations we build". Nobody is claiming enterprise-grade anything. After auditing a product in this same batch that claims SOC 2, PCI DSS Level 1 and ISO 27001 with nothing behind them, this reads as a competitive advantage.
• A clean credential scan across nine classes; nothing exposed in the bundle.
• No client-to-database calls on the public surface — B2 scores Inferred at 8 of 11 rather than the 5.5 Unknown that four other products in this batch earn.
• A path that doesn't exist returns a real 404, which three products in this batch fail.
• The feature descriptions are concrete: currency-aware pricing, flexible billing cadences, duplicate detection, annual-versus-monthly comparison. No adjectives doing the work of specifics.

The engineering underneath

All six security headers are missing on the host that serves the site. On a 0.3 MB static-feeling front end, X-Content-Type-Options: nosniff and X-Frame-Options: DENY are one line each and would take the B1 score up with them.

Not one contact route is published. An email address, a form reachable without an account, a support page — the site offers none of them. For a product asking people to trust it with a spending profile, "how do I ask a question before I sign up" currently has no answer.

The score

Part B is 30 of 45 — the highest engineering score in this batch of ten, above products with far more behind them. Part A is 22 of 55, and 2 of the 16 available on Trust and Commercial Clarity. The gap between those two numbers is the whole audit.

What I'd fix first

1. Write a privacy policy and a terms page. Two documents, an afternoon, and they move this product further than any feature on the roadmap. Say what you collect, where it lives, how someone deletes it, and who you are.
2. Publish a contact address. Anything. hello@zubly.app with a mailbox behind it.
3. Add the six security headers.
4. Serve robots.txt and a sitemap.xml, and pick a canonical host.
5. Keep the version badge. It's the most honest thing on the site, and when the policies land it'll read as confidence rather than an excuse.

Disclosure

Findings went to the operator before this published. These audits are free and public; the paid version is a Code Health Check, and the rescue work after it is Track 03 on my services page.

Data Access scored Inferred rather than Confirmed: nothing on the public surface talks to a database directly, which is the shape you want, but the authenticated application was not exercised.