Checks

What one scan finds.

The problems AI-written apps ship with most, in plain terms. Each page shows a real example, what VibeDoctor reports, and what it can’t see.

npx @neuralaxis/vibedoctor scan

src/config.ts

1export const GITHUB_TOKEN = "ghp_••••••••••••••••••••••••••••••••••••";

Leaked API keys Tokens written straight into source to make the demo work.

src/client.ts
```
2await fetch("/api/user", { method: "POST" });
```
Broken API routes The UI calls a route the server does not answer. See the check →

src/handler.ts

4} catch (error) {5}8  await Promise.reject(new Error("write failed"));9} catch (error) { return { ok: true }; }

Errors returned as success A failed save that still says “Saved”.

src/service.ts

6console.log("processing user", user.email, user.phone);7logger.info("customer payload", user);12content: `Summarise account for ${user.name} email=${user.email}`16return client.chat.completions.create({ model, messages });

Personal data in LLM prompts Emails and phone numbers pasted into model prompts and logs.

website/package-lock.json
```
"astro": "5.18.2"   → advisory fixed in 6.3.3
```
Vulnerable packages Old versions pinned from training data, with published advisories. See the check →

src/auth.ts

1// TODO remove old auth fallback later2export function legacyAuthFallback() {7  // const oldClient = createClient()8  return legacyAuthFallback();

AI leftovers and dead code Old fallbacks, commented-out code, and files nothing imports.

Also in the box

DPDP technical readiness, 38 controls.

For apps that handle personal data of people in India: a data map, a control matrix, and a review queue built from your code. The DPDP scan →

Types, lint, tests, duplication and complexity are covered too. The full tool matrix →