Audit Code for Production Readiness

Vibe Code Auditor evaluates prototype-quality or AI-generated code to determine whether it's actually robust, maintainable, and production-ready, surfacing hidden technical risks and architectural weaknesses invisible during casual review, without rewriting code or flagging cosmetic issues - just real risks with the minimum fix needed.

Use this when code was generated or heavily AI-assisted, a system evolved without deliberate architecture, a prototype needs productionizing, code works but feels fragile or inconsistent, hidden technical debt is suspected, or a project is being prepared for long-term maintenance or team handoff.

It starts with a pre-audit checklist (confirm input received, define scope as snippet/single-file/multi-file, note or assume context) and a 60-second quick scan (file/line counts, languages/frameworks, obvious red flags like hardcoded secrets or bare excepts, entry points and data flow). It evaluates seven dimensions: architecture and design (separation of concerns, god objects, tight coupling, circular dependencies), consistency and maintainability (naming inconsistencies, copy-paste logic, magic numbers), robustness and error handling (missing input validation, silent-failure catch-alls, missing timeouts or retries), production risks (hardcoded config, missing observability, N+1 queries, no graceful shutdown), security and safety (unsanitized input, hardcoded credentials, SQL injection, insecure deserialization), dead or hallucinated code (unused definitions, imports that don't exist in dependencies, references to nonexistent library APIs), and technical debt hotspots (deep nesting, too many parameters, missing type hints, test coverage gaps), each backed by a pattern-recognition table mapping specific strings and patterns, such as eval(), bare except:, or a requests.get without a timeout, to a likely issue and a quick check. Findings must be grounded in the actual code provided, never invented, and given a specific file and line location whenever possible.

The report follows a fixed structure: an executive summary of 3-5 bullets stating overall deployability, Critical Issues with location, dimension, problem, fix, and an optional before/after code snippet each, High-Risk Issues and Maintainability Problems in the same format, a Production Readiness Score out of 100 computed by a fixed algorithm - start at 100, -15 per critical issue, -20 if security-related, -8 per high, -3 per medium, -5 additional for 3+ similar pervasive issues - mapped to five score bands from "not deployable" (0-30) to "production-ready" (86-100), and a Refactoring Priorities list ranked P1-P5 with effort (S/M/L) and impact per item, plus a Quick Wins list of sub-1-hour fixes. Depth is calibrated to code size: snippets under 100 lines get only security, robustness, and obvious-bug checks, single files of 100-500 lines add architecture and maintainability, and multi-file systems over 500 lines get the full seven-dimension audit; production code emphasizes security and failure modes, prototypes emphasize scalability limits and debt. It names five related skills for follow-up work: schema-markup, analytics-tracking, seo-forensic-incident-response, test-driven-development, and security-audit for a deeper dive on confirmed critical vulnerabilities.

Developers or teams who need an honest, evidence-based verdict on whether AI-generated or rapidly-iterated code is safe to ship - not a rewrite, not a style nitpick, but a prioritized, scored list of the specific risks that would actually cause a production incident.