See what the AI actually built before you bet on it
Point VibeDocs at a vibe-coded app and get back an 8-section due diligence report with a risk score, a secrets inventory, and a prioritized fix list. Ready in minutes, built for buyers, founders, and developers.
DocuChat AI
Next.js 14SupabasepgvectorOpenAIStripeVercelAI-powered PDF document reader and semantic vector search with Stripe subscriptions
Executive Summary & Risk Score
Verdict
DocuChat AI is a functional AI-generated micro-SaaS application with verified revenue traction ($3,200 MRR, 170 active subscribers). While the core document retrieval loop operates effectively, the application carries moderate technical and operational liabilities—specifically exposed error-reporting webhooks, unverified multi-tenant vector isolation, and hosting tied to a personal account with single-operator bus factor. Verdict: PROCEED WITH CAUTION (Remediate P0 items prior to acquisition closing).
Risk Score
Risk Score: 64/100
| Category | Score | Max | Key Driver |
|---|---|---|---|
| Technical Risk | 19 | 30 | Zero test coverage; 60s serverless timeout risk on large PDFs |
| Security Risk | 18 | 25 | Hardcoded Slack webhook in source; credentials held in personal account |
| Operational Risk | 15 | 25 | Automated backups active on Supabase but restore never tested; bus factor: 1 |
| Business Risk | 12 | 20 | Single AI vendor dependency (OpenAI text-embedding & GPT-4o-mini) |
| Total | 64 | 100 | Moderate overall risk profile across all 4 rubrics |
Top 5 Red Flags
- Slack error webhook is hardcoded in production source code — Exposes internal error telemetry endpoint; requires immediate rotation and move to environment variables.
- Serverless execution timeout on documents > 50MB — PDF parsing runs synchronously in Vercel route handlers; triggers HTTP 504 timeouts without worker queues.
- Multi-tenant RLS isolation on pgvector chunks is unverified — Custom
match_doc_chunksRPC needs rigorous audit to ensure users cannot retrieve cross-tenant vectors. - Hosting and DNS reside on founder's personal accounts — Transfer of Vercel and Namecheap assets required prior to transaction completion.
- Bus factor of 1 with zero test suite — No unit or end-to-end tests exist; incoming operators face high regression risk during code updates.
Vibe-coded apps are black boxes
AI wrote the code, but nobody wrote down how it works. So buying one, taking one over, or selling one means guessing.
Buying is a gamble
The demo looks great, but you can't see the hardcoded secrets, the missing backups, or the single point of failure hiding in the code.
Handovers lose context
Every decision lives in your head and old chat logs. A new developer starts from zero and spends weeks reverse-engineering what the AI did.
Selling without proof kills deals
Serious buyers ask hard questions. Without an independent report you have no answers, and the deal stalls or the price drops.
Don't sign, hand over, or list an app you can't explain. Get the report first.
From black box to shareable report in 3 steps
No installs, no agents, no repo access required. Just answers and a code excerpt.
Describe the app
Paste a code excerpt or a repo link so the analysis has real signal to work from.
Answer the interview
Ten quick questions about how it runs, who has access, and what could break.
Get your report
A shareable due diligence report with a risk score, ready in minutes.
What's in the report
Eight sections that answer the questions buyers and developers actually ask. A consistent artifact, not a chat transcript.
Risk Score & Summary
A plain-English verdict plus a 0–100 score, so you can compare apps at a glance.
Architecture Overview
Services, data flow, and integrations, with a diagram you can share.
Data & Storage Map
What data lives where, who can access it, and where the sensitive bits are.
Secrets Inventory
Every API key, credential, and env var the app depends on, and which are exposed.
Dependency Risk
The third-party packages and services it relies on, and what breaks if one disappears.
Operations Runbook
How to deploy, monitor, back up, and recover the app, written for someone else.
Bus Factor & Gaps
What only lives in the founder's head, and what breaks if one person walks away.
Action Plan
Concrete fixes ordered by Now, 30, 60, and 90 days, so the next owner knows where to start.
Three reports, one source of truth
Pick the report that matches what you're doing with the app.
Due Diligence Audit
For buying or inheritingAn independent look at risk, secrets, dependencies, and operations, so you know exactly what you would be taking on before money or code changes hands.
Handover Report
For transferring to a developerEverything a new developer needs to run and extend the app: architecture, runbooks, credentials, and the knowledge that currently only lives in your head.
Sell-Ready Report
For sellingProof that answers buyer questions before they are asked, a professional artifact that keeps deals moving and supports your asking price.
Simple, one-time pricing
One report can save a deal, or save you from one.
Single Report
One report, one app
- One report of your choice: Audit, Handover, or Sell-Ready
- Executive summary with 0–100 risk score
- Shareable link for buyers or developers
- Markdown export
Full Pack
All three reports for one app
- All 3 report types: Audit, Handover, and Sell-Ready
- Executive summary with 0–100 risk score
- Shareable links for every report
- Markdown export
- Priority generation
One-time payment, no subscription.
Frequently asked questions
Common questions about VibeDocs reports.
Don't sign what you can't explain
Get the report before the deal, the handover, or the listing. One-time payment from $6.99.