Security review and patching
An application, dependency and server security review, followed by a monthly patching plan that keeps Laravel, PHP and every package up to date.
AI-first service
Vibe code review for AI-built apps
You shipped fast with Cursor, Claude Code, Lovable, Bolt or v0. Before real customers, real data and real attackers arrive, a senior Laravel engineer reviews the code and tells you exactly what to fix first.
Security first
Missing authorisation checks, exposed keys and unsafe queries are the most common serious problems we find in AI-written code.
Data you can trust
Migrations, validation, transactions and backups decide whether one bad deploy loses customer data.
Ready for real load
We profile the busy paths for N+1 queries, missing indexes and slow work that should be queued.
A fix list, not a lecture
Every finding is ranked, explained in plain English and paired with a suggested fix.
What is a vibe code review?
A vibe code review is an independent check of an application that was written mostly by AI coding tools. A senior engineer reads the code, tests the risky parts and tells you what will fail when real users, real data and real attackers arrive. You get a ranked list of problems and a clear order to fix them in.
AI tools are now very good at producing code that works in a demo. They are much less reliable at the parts that only matter later: who is allowed to see which data, what happens when a payment webhook arrives twice, and whether last night's backup can actually be restored.
Why AI-built apps need a different kind of review
A traditional code review looks for mistakes in code that a person designed. AI-written code fails in different ways, so we look for different things.
- What is missing matters more than what is there. The code that exists is usually tidy. The problems are the authorisation check that was never written, the rate limit nobody asked for and the validation that only happens in the browser.
- The same job is done three different ways. Each prompt produces a slightly different pattern, so the codebase becomes hard to change safely.
- Packages appear that nobody chose. AI tools sometimes suggest packages that are abandoned, unnecessary or do not exist at all. Attackers now register those invented names in the hope that someone installs them, a tactic known as slopsquatting.
- Secrets end up in the wrong place. API keys pasted into prompts often land in front-end code, configuration files or the Git history.
- Tests prove very little. Generated tests often check that the code does what it does, rather than what it should do.
What we check
| Area | What we look for | A typical finding |
|---|---|---|
| Access control | Policies, gates and ownership checks on every route and API endpoint | Any signed-in user can open another customer's invoice by changing the ID in the URL |
| Secrets | Keys in code, front-end bundles, logs and Git history | A live Stripe secret key committed six months ago |
| Data | Migrations, foreign keys, transactions, soft deletes and backups | Orders saved without a transaction, so a failed payment leaves half an order behind |
| Performance | Query counts, indexes, caching and queues | A dashboard that runs 180 database queries per page load |
| Integrations | Webhook signatures, retries and idempotency | Payment webhooks accepted without verifying the signature |
| Operations | Error tracking, logging, deploys and restores | No error tracking, so the first sign of a bug is a customer email |
What you get
Your report starts with a one-page summary written for founders and managers: the overall risk, the three things to fix this week, and a rough effort estimate for everything else.
The detailed findings follow. Each one includes where the problem is, why it matters, how to reproduce it, a suggested fix and an effort estimate. Where it helps, we also include a short prompt you can give to your AI coding tool so that it applies the fix in the way we recommend, rather than inventing its own.
Who it is for
- Founders who built a product with AI tools and are about to take payments, store personal data or sign a business customer.
- Product teams using AI coding agents every day who want an outside view before a big release.
- Investors and buyers who need technical due diligence on a product that was built quickly.
If you are still at the idea stage, our AI-driven development service may be a better fit: we use the same AI tools, with senior engineers setting the guardrails from day one.
After the review
Most clients fix the critical findings within a week. We can do that work for you, or support your team while they do it. If the review shows that the codebase needs more than fixes, we will say so plainly and explain the options, from a focused rescue to a staged rebuild on Laravel. For apps that handle payments or personal data, we usually suggest following up with a full security review and a patching plan.
Scope
What's included
- A full read of the codebase by a senior Laravel engineer, supported by static analysis and AI-assisted review
- Authentication and authorisation checks on every route, controller, job and API endpoint
- Secrets and configuration review, including keys that were committed to Git history
- Dependency audit for known vulnerabilities, abandoned packages and packages that should not be there
- Database review covering migrations, indexes, constraints, transactions and N+1 queries
- Validation, file uploads, emails and payment webhook handling
- Test coverage review, with the five tests worth writing first
- Deployment, logging, error tracking and backup readiness
- A written report with every finding ranked critical, high, medium or low
- A 45-minute call to walk through the report with you
Not included
- Fixing the issues. We can quote for that, or your team can work from the report.
- Penetration testing of live servers. That is part of our security review.
- Design and user experience feedback.
Process
How it works
Share access
Give us read-only access to the repository and tell us how the app is deployed. We sign your NDA first if you need one.
Automated sweep
Static analysis, dependency audits and AI-assisted review map the codebase and flag anything suspicious.
Senior review
A senior engineer checks every flag by hand and reads the critical paths line by line, including sign-up, login, payments and data access.
Report and call
You get a ranked report within five working days, then a call to agree what to fix first.
FAQ
Frequently asked questions
What is vibe coding?
Vibe coding is building software by describing what you want to an AI tool and accepting the code it writes, often without reading it closely. The term was coined by Andrej Karpathy in February 2025. It is a fast way to get a working prototype, but the code still has to be safe, maintainable and able to run in production.
Do you use AI to do the review?
Yes, for the first pass. AI-assisted tools help us map a codebase quickly and spot patterns worth checking. Every finding in your report is then confirmed by a senior engineer, who also reads the critical paths by hand. We agree with you up front which tools may see your code, and we can do the whole review without AI tools if you prefer.
How long does it take?
Five working days from the day we get access to the repository, for codebases up to about 50,000 lines. Larger codebases get a fixed quote and timeline before we start.
My app was built with Lovable or Bolt and is not on Laravel. Can you still help?
Often, yes. Many AI app builders produce React or Next.js front ends with a hosted database. We review the parts we know deeply, and on the first call we will tell you honestly if another specialist would serve you better. If the app has outgrown its builder, we can also plan a move to Laravel.
Can you fix what you find?
Yes. Most clients ask us to fix the critical and high findings straight away, either at our hourly rates or as a fixed-price package. You are also free to hand the report to your own team or your AI tools.
Will my code stay confidential?
Yes. We work under NDA on request, only need read-only access, and remove our access when the review is finished. We never publish anything about your project without your written permission.
What if the review finds nothing serious?
Then you have written evidence that the code is in good shape, which is useful for investors, enterprise customers and insurers. In our experience that is rare for code written mostly by AI, but it does happen.
Keep exploring
Related services and guides
Laravel rescue and takeover
We take over struggling Laravel projects, whether written by people or AI, stabilise them quickly and get delivery back on track.
AI-driven development
We build and extend Laravel applications using AI coding agents, with senior engineers setting the architecture, reviewing every change and owning quality.
AI-first development
Taking a vibe-coded app to production: a 25-point checklist
Built your app with Lovable, Bolt, Cursor or Claude Code? This checklist covers the security, data, payments and reliability gaps to close before real customers arrive.
Talk to a senior Laravel engineer
Book a free 30-minute call. Tell us what you are building or what is worrying you, and we will tell you honestly what we would do, what it costs and how long it takes.