What does an AI software audit check?
Architecture
Service boundaries, coupling, and data ownership as they were actually built rather than as they were described.
Authentication
Session handling, token lifetimes, password and OTP flows, and the reset paths that are usually generated last.
Authorization
Whether every endpoint checks who is asking, and whether that check happens server-side.
Database security
Row-level security, tenant isolation, migrations, indexes, and the queries that only work at current data volume.
API security
Input validation, rate limiting, mass assignment, error verbosity, and CORS policy on every public surface.
Dependencies
Known CVEs, abandoned packages, and the transitive tree that arrived with a generated scaffold.
Secrets
Where keys live, what is committed, what reaches the client bundle, and whether anything can be rotated.
Infrastructure
Hosting, networking, storage permissions, environment separation, and backup and restore that has been tested.
Observability
Logging, error tracking, and alerting, judged by whether an outage would be noticed before a customer reported it.
Performance
N+1 queries, synchronous work on the request path, payload sizes, and cold-start behaviour.
Scalability
The load the current design carries, the point it stops carrying, and what changes first.
AI/LLM risks
Prompt injection, unbounded tool permissions, provider key exposure, cost runaway, and unvalidated model output.
Testing
Whether the critical paths have any coverage at all, and whether the existing suite would catch a regression.
Deployment
Build reproducibility, migration safety, rollback, and what happens when a deploy fails halfway.
Maintainability
Duplication, dead code, inconsistent patterns, and the parts of the codebase no human has read.
Other audits
Each audit answers a different question. Most engagements combine two or three.
Build with
confidence.
AI builds the product. Vibecop makes sure it won’t break in production, fail under scale, or expose your users to risk. One audit. Fewer expensive surprises.