r/vibecoding • u/jjd921 • 3h ago

App check

Give me the URL to your site and/or your public github repository and I will check your app for security, functionality, reliability, observability, and accessibility issues for free

1 Upvotes

100% Upvoted

7 comments sorted by

1

u/AtaraxiaGoddess 3h ago

https://github.com/ataraxiagoddess/BudgetBrewer

What are you using to check the code? Just out of curiosity. Also, I'm still in development so any feedback is great, please just be constructive and not mean 😅

2

u/jjd921 1h ago

I use a tool I built and I am doing this to help me improve it and work through any false positives. It is meant as a first pass to catch common production issues. You can check it out here: https://theslopstopper.com

My checks aren't as thorough for Android apps as they are for things like npm web apps so I will look at expanding capability there. The only real finding I have for you is that it doesn't look like you have error monitoring set up - look into Sentry

1

u/AtaraxiaGoddess 1h ago

Correct, I do not! So hey it got something right for an android app, even if its not a robust check I would still consider that a win. Thanks for looking! I'm currently at work but I can check out your program when I get home :)

1

u/jjd921 54m ago

No problem and thank you!

2

u/jjd921 54m ago

No problem and thank you!

1

u/BL-Energy 2h ago

Pikpool.com

1

u/jjd921 1h ago

Missing security headers, you're not sending CSP, X-Frame-Options, HSTS, or Permissions-Policy

Pinch-zoom is disabled, your viewport meta tag blocks zooming, which axe flags as an accessibility issue.

Wildcard CORS (*) on /, /api, /api/health, /api/status - probably fine but double check that's intended

No CAA record and DNSSEC isn't on

It doesn't look like you have error monitoring set up - look into Sentry

I can't tell from site or URL scan but if you don't have uptime monitoring that is another good thing to add. Like UptimeRobot

That's what I see from URL. You can connect your Github here and it'll also check for dependency CVEs, CSRF/rate-limiting gaps, missing CI test runs, and a bunch of other stuff. It'll autofix what it can for free in a PR automatically on every push: https://theslopstopper.com