High · act first
Close the open door first.
The open high-severity gap stays open, whatever happens to the system next. We close it within days, verified by a rescan.
€540
Fixed price, net, one-off. Credited towards a rebuild (90 days).
decivo Scan · For vibe coding projects
Built with AI. Ready for real users?
Your app works. But what was overlooked while building it? The scan checks your publicly reachable application for security, privacy, accessibility and technology, and tells you what it costs to fix.
Works for websites too. For WordPress sites, the result shows how to work out with WP Exit whether a move pays off.
This is what your result looks like.
Stop
This needs fixing before you go any further.
Stop, because the database can be read and written from the browser. The other 8 findings can be repaired.
- Security4 findings, 1 high
- Law & privacy3 findings, 1 high
- Architecture indicators1 finding, 1 high
- Accessibility1 finding
- Code indicators0 findings
- Scaling & cost0 findings
104 of 165 checks run. 55 need access. 6 can never be reached from the outside.
Database wide open (composite)
With the public key from the frontend, tables can be queried and changed directly.
Tracking cookies set before consent
An analytics service sets cookies before visitors have agreed.
Form fields without labels
Anyone booking with a screen reader doesn't learn what goes into the fields.
What now?
Then
Rebuild
Building on costs more than rebuilding. What carries over from what you have, we work out in a first call.
Price after a joint review
Every offer starts with a call that looks at what you already have.
What we can't see, we don't claim.
What we check.
The catalogue is tailored to the typical weaknesses of vibe code.
Security
What does someone see who isn't logged in, and what can they do with it?
Law and privacy
Which services, trackers and third countries are in your app without you putting them there?
Accessibility
Can everyone use your app, and since the BFSG, do you even have to prove it?
Scaling and cost
Do bundle, caching and images hold up under real traffic?
Architecture indicators
Can you tell from the outside whether the foundation holds, or whether the next feature breaks the one after?
Code indicators
Does the code show the typical patterns of AI-generated apps: duplicated logic, dead paths, missing error handling?
Three check depths, all free.
Our catalogue has 167 checks. From the outside, up to 104 of them run. The rest is still in your report: as "needs access", not as "passed". We don't guess.
Public
Passive checks that any browser performs on every visit anyway. No access needed, done in a few minutes.
Proof of ownership
More checks: the ones that may only run with proof, plus the badge with go. Meta tag, DNS record or a file on the server, one is enough. None of them changes anything about your app.
Repository
Read-only GitHub access. Now we see architecture, dependencies and implementation. Makes the repair price binding.
You only pay if you want someone to do the repair.
After the scan: a recommendation with a price.
Which route fits is in your scan result. You don't have to work it out yourself.
Immediate protection
€540Fixed price, one-off, net
We close all open high-severity security and privacy gaps from your scan. Delivered within days, verified by a rescan.
For anyone with open high-severity gaps, whatever the verdict.
Start scanRepair plan
€349net, one-off
A plan for your project to fix it yourself: locations, order and a ready-made prompt per fix unit. The next rescan shows whether it holds.
Requires the repository scan, which is free.
Start scanRepair and stabilisation
from €1,090net, fixed price from your scan
We implement all fix units and stabilise what depends on them, architecture findings included. Verified by a rescan.
Binding after the repository scan.
Start scanRebuild
from €12,500Price after a joint review
A new foundation as a Code Prototype. What you have is carried over wherever it holds.
For a Stop verdict. A call that looks at what you have confirms it first.
Book a call
Immediate protection is credited towards a rebuild (90 days). The repair always uses the current state of your scan. All prices net, plus VAT. We reply to every request within 24 hours.
How the rescue works: Vibe Code RescueWhat you want to know first
Is the scan safe for our app?
Yes, at all three depths. The outside scan performs passive checks only, the same requests any browser makes on every visit, no attacks, no load. Proof of ownership is a meta tag, a DNS record or a file on the server, none of which changes anything about your app. The repository scan only reads, and only the repositories you pick. Please only scan applications you run yourself or are allowed to have checked.
What happens to our URL and the result?
The result is yours and lives in your browser, we don't file it under your name. We only keep what you trigger yourself: a shared permalink, an anonymous aggregate for our statistics (host as a hash, never the address) or a repository scan, whose data is deleted after 90 days.
How long does it take?
A few minutes. You watch the progress live.
Our app isn't live yet or is password-protected.
Then go straight to the repository scan with read-only GitHub access. It still needs your app's address, because we also check it from the outside. If the app isn't public yet, enter the preview or staging address. If it isn't reachable, the repository scan still runs, only the outside part is missing. Go to the repository scan
What does it cost afterwards?
The scan names a route with a price: immediate protection for €540 if high-severity gaps are open. The repair and stabilisation from €1,090 as a fixed price from your scan, binding after the repository scan, or the repair plan for €349 if you fix it yourselves. A rebuild starts at €12,500 and is priced after a joint call, never before.
Do I have to buy anything to see the result?
No. All three check depths and the full report are free.
Why is the price after the URL scan only a lower bound?
The fix units from the outside scan are certain. The repository can add units, such as database rules or outdated packages, but never remove any. That's why the price stands after the URL scan, and you see beforehand what might still be added.
No repo. No call. A result in a few minutes.
We wanted to know how good AI-built apps really are. Now you can too.
What we found across hundreds of apps: the AI App Radar