How We Audit

What Framework Does Every LRC Audit Follow?

Across the 700+ vibe-coded applications Launch Ready Code has scanned, most have at least one critical security finding at their first audit, with an average Launch Readiness Score around 44/100. Our approach maps directly to the OWASP Top 10 and severity scores from the NIST National Vulnerability Database.

What Are the 4 Dimensions Every Audit Covers?

Every audit covers exactly these four dimensions — no more, no less.

What Tools Does the Enhanced Audit Stack Include?

Beyond the four core dimensions, every scan includes:

• SSL/TLS grade — via SSL Labs methodology (A–F). Checks certificate validity, protocol version, cipher suite security, and HSTS configuration.
• HTTP security headers grade — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Missing headers are the most common misconfiguration we find.
• Open port exposure — via Shodan. Databases, admin services, and internal APIs that are reachable from the public internet when they should not be.
• Live rate limiting probe — we actively test whether your login, signup, and API endpoints enforce rate limits. We don't just check config — we test it.
• Benchmark comparison — your score compared against the average for apps on your stack (Supabase, Vercel, Render, etc.). Gives you context for where you sit relative to similar apps.

What Does LRC Not Cover — and Why?

Honesty about scope is part of our methodology. We do not audit:

• UX, accessibility, or SEO
• Legal compliance certification — SOC 2, HIPAA, GDPR. We can identify gaps and prepare you for certification, but we don't certify.
• Business logic correctness — whether your app does what it's supposed to do
• Design quality or mobile-specific issues (unless they surface as a security or performance finding)

If you need those audited, we'll tell you. We don't pretend to cover more than we do.

How Does a URL-Based Audit Work Without Code Access?

"I thought security audits required code access."

Traditional security audits do. They require a consultant to sit with your codebase for weeks and charge $15,000–$50,000. That model works for enterprise software where a full source review is genuinely required.

LRC works differently: outside-in, the same way a real attacker approaches your app. If a vulnerability is exploitable from the internet — which is the kind that matters — we find it without reading your code. Your deployed application exposes its attack surface whether or not we have source access.

This is why we can deliver a full four-dimension audit for $499 instead of $15,000, and deliver it engineer-verified within 48 hours instead of 2 weeks.

The DFY Technical Setup ($1,999 setup fee, includes Month 1 of Growth Retainer, then $2,999/mo) is our source-code-access product — a senior engineer reviews your full repository and implements the fixes. That's the right tool when you want engineer-led implementation, not just the report.

How Does the Audit Handle AI-Generated Code Specifically?

Apps built with Lovable, Bolt.new, Cursor, Replit, Windsurf, v0.dev, Claude Code, and GitHub Copilot share a distinct security risk profile — different from hand-written code in ways that traditional scanners miss.

LRC audits explicitly flag AI-code-specific vulnerabilities, including:

• Exposed API keys and secrets — AI tools frequently hard-code environment variables in client-side bundles; our audit scans deployed assets for leaked credentials.
• Disabled Row-Level Security — Supabase projects generated by Lovable and Bolt.new commonly ship with RLS disabled on all tables, leaving your entire database readable without authentication.
• Missing rate limiting — AI-scaffolded API endpoints rarely include rate limiting or abuse controls by default, exposing you to credential stuffing and DDoS.
• Authentication weaknesses — Default auth flows in AI-generated code often skip session expiry, CSRF protection, and secure cookie flags.
• Prompt injection vectors — Apps with LLM-backed features are checked for input paths where user data reaches a language model without sanitisation, enabling adversarial prompt injection.
• Insecure HTTP headers — Missing Content-Security-Policy, X-Frame-Options, and HSTS are endemic in AI-scaffolded apps; we flag and score each.

How does this compare to continuous scanners like Intruder or Snyk?

Continuous vulnerability scanners are designed for established engineering teams managing ongoing infrastructure. LRC is designed for the moment before and around launch — when you need a fast, comprehensive answer about whether your app is safe to ship.

LRC is not a replacement for continuous scanning in mature engineering organisations. It is the fastest route from "I just shipped this" to "I know it is safe to ship."

How Is Security for AI-Generated Apps Different?

Traditional security tools were designed for code written by humans following software engineering practices. AI-generated code breaks those assumptions in three consistent ways.

Platform-shaped gaps. Each AI builder introduces the same configuration gap across every app it generates. Lovable wires up Supabase without enabling row-level security by default — the gap at the root of CVE-2025-48757. Bolt skips HTTP security headers. Cursor-generated code typically ships without error tracking or alerting. A generic scanner sees none of this because it does not know which tool generated the code. Our scanner detects the platform and applies the right platform-specific rule set.

Speed-to-deploy pressure. A vibe-coded app can go from idea to live URL in under an hour. That speed compresses or eliminates the review steps a traditional team would run before launch: dependency audit, secret scanning, header check, load test. Our audit is designed to run in the same time frame — under two minutes for the full four-dimension report.

Confidence mismatch. AI tools write code that works, which creates an implicit assumption that it is safe. That assumption fails at the 44/100 average we see across 700+ audited apps. The code runs. The security and reliability properties are often absent.

How Does LRC Compare to Burp Suite and Traditional DAST Tools?

DAST tools (Dynamic Application Security Testing) test live apps. So does LRC. But the comparison stops there.

The practical rule: run LRC before you launch. If a contract or compliance audit requires a formal penetration test, hire a firm specifically for that engagement. The two are complementary, not substitutes.

See the methodology applied to your app?

Free scan. No code access. No signup. Results in under 60 seconds.