What does a Claude Code audit check?
Agent-authored changes
Multi-file edits accepted in a single session, reviewed properly for the first time.
Project instructions
Whether CLAUDE.md encodes the real constraints, and where the code contradicts it.
MCP servers and tools
What connected tools can reach, the credentials they hold, and their trust boundary.
Permission configuration
Allowed commands, hooks, and automation that can act without a human in the loop.
Secrets
Credentials in the repo, in environment files, or reachable by an agent session.
Architecture drift
Structure that evolved session to session without a single owning design.
Duplication
The same capability implemented more than once because context did not carry across sessions.
Access control
Server-side authorization on every endpoint, including internal and admin routes.
Input validation
Trust boundaries validated in code rather than assumed by the prompt.
Database access
Schema, constraints, indexes, migrations, and destructive operations without guards.
Dependencies
Packages the agent introduced, their CVEs, and the ones no longer used.
Test quality
Whether generated tests would fail if the behaviour broke.
Error handling
Failure paths that log and continue where they should stop.
Performance
Request-path work, N+1 queries, and cost under real concurrency.
Production readiness
Deployment, monitoring, backups, rollback, and operational ownership.
Other audits
Each audit answers a different question. Most engagements combine two or three.
Build with
confidence.
AI builds the product. Vibecop makes sure it won’t break in production, fail under scale, or expose your users to risk. One audit. Fewer expensive surprises.