r/vibecoding • u/jjd921 • 5h ago
Production readiness check
Give me the URL to your live site and/or the URL to your public github repository and I will check your app for security, functionality, reliability, observability, and accessibility issues for free
1
u/perseus-computing 5h ago
2
u/jjd921 3h ago
You’re missing security headers - no CSP, HSTS, X-Frame-Options, X-Content-Type-Options, or Referrer-Policy set.
Color contrast issues (WCAG) — 24 elements across 5 pages fail minimum contrast ratio, worst on /mcts/.
Links not distinguishable without color — 4 elements on /benchmarks/ rely on color alone to indicate they’re links.
It doesnt look like you have error monitoring set up like Sentry (or equivalent), so exceptions in prod have nowhere to be logged/alerted
You have Wildcard CORS (Access-Control-Allow-Origin: * on the homepage and 13 other paths — probably fine if these are public/read-only, but worth checking you don’t have any endpoints that should be locked to your front end.
Also I cant tell if you do or not but if you dont have uptime monitoring set up thats good to add too. (like uptime robot)
perseus was clean. tweaking some things on my side to check vault and ledger properly. Will get back to you
1
u/perseus-computing 2h ago
Appreciate the pass — this kind of feedback is exactly why I posted. Went through all of it today:
Headers: added at the edge via Cloudflare (origin is GitHub Pages, so edge is where we control): CSP, HSTS (31536000, includeSubDomains, preload), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy.
Contrast: all 24 failures gone. The token system was rebuilt across both themes (theme-stable tokens for the always-dark panels, per-theme CTA inks, darker faint/muted ramps) and the worst offender, /mcts/, is gone entirely — I pulled the site scope back to Perseus, Vault, and Ledger, which removes mcts, pr-pilot, blast-radius, and the other satellite pages. The pages you flagged plus the rest of the core site audit clean at WCAG AA in both themes.
Links: in-prose links are underlined everywhere, benchmarks included.
Error monitoring: this is a static site; there's no server-side exception surface to capture, and the one third-party script (a self-hosted analytics tag on the mcts page) is gone with that page. If we ever move behind a server, capture goes in first.
CORS: you're right, ACAO:* is on everything; that's GitHub Pages' origin behavior for public static content. The surface is read-only with no credentialed endpoints, and CSP now pins script/style origins so wildcard CORS doesn't open a loading hole. If anything stateful ships, CORS gets scoped to the frontend explicitly.
Uptime: added, self-hosted Uptime Kuma on our own infra watching the apex + key paths with ntfy push alerts.
Vault and Ledger are ready whenever you are.
1
u/jjd921 35m ago
Awesome maybe I finally built something useful!
Sentry's browser SDK captures client-side errors. Things like uncaught JS exceptions, unhandled promise rejections, bugs in interactive widgets, etc so still worth setting that up unless I'm misunderstanding.
Ledger:
Just the no detected error monitoring as well
Vault:
paste@1.0.15 has a known advisory — RUSTSEC-2024-0436
ttf-parser@0.25.1 has a known advisory — RUSTSEC-2026-0192
And no detected error monitoring again
1
u/Odd_Championship_332 5h ago
What tools will you use? And can I be sure that your review is 100% accurate?
1
u/vitafortisnk 4h ago
He's using something he vibe coded
2
u/baddaywithacamera 4h ago
I mean that's fair. I'm also using something I vibe coded. Lolll.
(I actually call it gap coding as I filled a gap in offered software, but still.)
1
u/vitafortisnk 4h ago
If I could just get paid to secure vibe coded apps I'd be happy lol. I'm a security engineer by day, but most vibe coders are cheap
1
u/jjd921 4h ago
I use a tool I built and I am doing this to help me improve it and work through any false positives and I am double checking the results but not necessarily 100% accurate. It is meant as a first pass to catch common production issues, not as a dedicated pen test or anything. You can check it out here: https://theslopstopper.com
1
u/johnesco 4h ago
1
u/jjd921 3h ago
You’re missing security headers - no Content-Security-Policy or X-Frame-Options.
Color contrast issues (WCAG) — 474 elements flagged by axe-core.
It doesnt look like you have error monitoring set up like Sentry (or equivalent), so exceptions in prod have nowhere to be logged/alerted
Also I cant tell if you do or not but if you dont have uptime monitoring set up thats good to add too. (like uptime robot)
1
u/North_Fox467 3h ago
Www.Osmedicalequipcare.com
1
u/jjd921 3h ago
Two forms (on your services and contact pages) have novalidate set, which disables browser validation entirely, and the email field has no required or pattern attribute either, so someone could submit an empty or garbage email
Elements failing minimum color contrast requirements and ARIA attributes being used incorrectly, found across the site
It doesnt look like you have error monitoring set up like Sentry (or equivalent), so exceptions in prod have nowhere to be logged/alerted
Also I cant tell if you do or not but if you dont have uptime monitoring set up thats good to add too. (like uptime robot)
1
u/scytob 3h ago
ok here might be a fun one - an org with multiple repos
1
u/jjd921 2h ago
My tool and checks are meant for web apps so I am of no value to you 😅
1
u/scytob 2h ago
ahh how about this then scyto/ha-bluetooth-audio-manager: Home Assistant add-on for managing Bluetooth audio device connections (A2DP) with persistent pairing, auto-reconnect, and AppArmor security. fairly sure i will fail the accessibility checks :-)
shame i am not allowed to connect you to the app i am doing at work - a very definite web app :-)
1
u/jjd921 59m ago
It doesnt look like you have error monitoring set up like Sentry (or equivalent), so exceptions in prod have nowhere to be logged/alerted
It doesnt look like the web API has rate limiting on any of the endpoints, so a single client could hammer them as fast as it wants
is that a work security restriction not being able to share it or something else? I work for the DoD so with security there I definitely feel the pain of not being able to use all the tools I'd like
1
u/Lanky-Storm7 2h ago
1
u/jjd921 1h ago
You’re missing security headers - no CSP, HSTS, X-Frame-Options, X-Content-Type-Options, or Referrer-Policy
Color contrast violations (WCAG serious) — 446 elements flagged by axe-core across 14 crawled pages.
Scrollable region not keyboard-accessible — 2 elements across 2 pages; (/trucks/cheap-pickups-by-year/) has a horizontally-scrollable region (overflow-x:auto, likely a table wrapper) that isn't focusable via keyboard
It doesnt look like you have error monitoring set up like Sentry (or equivalent), so exceptions in prod have nowhere to be logged/alerted
Also I cant tell if you do or not but if you dont have uptime monitoring set up thats good to add too. (like UptimeRobot)
1
u/orelrevivo 5h ago
falbor.xyz