Vibe-coded? Get your fix list.fix list.

keys

A key left in the page's code or in the repo can be copied by anyone. They run your OpenAI, Stripe or database account, and you get the bill.

dbrules

AI tools often leave tables open. Then any logged-in user, sometimes anyone at all, can download every customer's data with one request.

leak

Pages, APIs and files behind the login are often reachable from their address alone. One shared or guessed link leaks customer data, a breach you may have to report within 72 hours.

auth

If the admin page only checks in the browser, typing its address is enough to get in. Whoever does can change users, prices and data.

payments

If the app unlocks paid features because the browser says so, people get them for free, or change the price before they pay.

limits

With no limits, one script can fire thousands of AI calls, sign-ups or messages. You pay for every one of them.

packages

Old packages have published holes that bots scan for. AI tools also invent package names, and attackers register those names with malware inside.

legal

The law asks for these once you collect data or take money, and Stripe and the app stores ask too. Missing ones invite fines and lawyers' warning letters.

gdpr

GDPR fines go up to 4% of yearly turnover. Swiss law fines the responsible person directly, up to CHF 250,000. And any user can ask to see or delete their data.

seo

Many AI-built apps send an empty page that JavaScript fills in later. AI search often never sees your content, and Google indexes it late or badly.

database

A messy schema makes every new feature harder, and changes made by hand can't be replayed on the live server. Without a tested backup, one bad prompt can wipe your customers' data.

server

A builder's preview link can vanish when a plan changes, and a server that isn't updated collects known holes. Without HTTPS, browsers warn your visitors away.

access

Old passwords, shared keys and open ports are how servers get taken over. We list who can get in, and what is open to the internet.

buttons

A dead button on sign-up or checkout loses customers without a sound. You only notice when the sales don't come.

devices

Most visitors arrive on a phone, many of them on Safari. If the layout breaks there, they leave before reading a word.

duplicates

AI copies code instead of reusing it. Fix a bug in one copy and the others keep it, and every new prompt gets slower and riskier.

structure

Swallowed errors show users a blank screen and leave you no trace to follow. Tests on sign-up and payment catch breakage before customers do.

scale

What runs fine for 10 users can stall at 1,000, and the cloud bill grows faster than the users. We find where it slows down, and what growth will cost.

rules

Without written rules, your AI tool slowly undoes the fixes. A rules file tells it how your app works and what it must not touch.

adminpages

Admin pages often rely on an address nobody is meant to guess. Bots try the usual ones all day, and whoever gets in can see and change everything.

selfadmin

If the role is a field users can edit, one request turns any account into an admin. AI tools often leave that field open.

resets

A reset link that never expires, or a login checked only on screen, lets strangers into real accounts. That's a breach you'd have to explain to customers.

injection

A name or comment field that runs code can steal your users' sessions or read your database. It takes one unprotected form.

idor

Change one number in a link and see someone else's order or invoice. It's one of the most common leaks in AI-built apps, and it takes seconds to try.

overfetch

The screen shows a name, but the data behind it often carries the email, phone and address too. Anyone can read it in the browser's developer tools.

buckets

IDs, invoices and photos in a public storage bucket can be found and downloaded by strangers, sometimes straight from a search engine.

logs

Logs get copied, shared and kept for years. A password or token in them is a key for whoever reads them next.

pii

An email in a URL ends up in analytics, browser history and other sites' logs. That's personal data shared without consent, and a GDPR problem.

opendb

Bots scan the internet for open database ports around the clock. An exposed database is usually found within hours, then copied or wiped.

gating

A hidden button is still there for anyone who looks. If the server doesn't check the plan, free users get everything you sell.

ratelimit

Without limits, a script can guess passwords all night, open thousands of fake accounts, or send spam from your domain until it's blocked.

spendcap

Every AI call costs money. Without a cap, one user or bot looping on your chat can turn a month's budget into one night's bill.

promptinj

Users can tell your AI to ignore its instructions. Without guards it reveals your prompt and other users' data, or does what it shouldn't.

bots

Bot sign-ups fill your database with junk, skew your numbers and burn your email quota. An open contact form becomes a spam relay.

privacy

A copied template that doesn't match what you collect is as bad as having none. Regulators and lawyers compare the policy with the app.

terms

Without terms you can't limit your liability or ban abusers. Sell to EU consumers without the right cancellation notice, and their 14 days to cancel become more than a year.

imprint

In Switzerland, Germany and Austria a site that does business must say who runs it. A missing imprint is a common, cheap reason for a lawyer's warning letter.

cookies

A banner that loads analytics before anyone clicks Accept still breaks EU rules. It's one of the first things regulators and privacy groups check.

dsar

Under GDPR every user can ask for a copy of their data or for its deletion, and you have one month to answer. Without a button, each request is manual work.

aiact

The EU AI Act requires telling people when they're talking to an AI. Users who feel misled also stop trusting the rest of the app.

licences

A stock photo or font without a licence can bring a bill of hundreds of euros per file. Some code licences oblige you to publish your own source.

meta

Google shows a page's title and description in its results. Without them it guesses, every page looks alike, and fewer people click.

crawl

A sitemap tells search engines which pages exist. One wrong line in robots.txt hides the whole site from Google.

og

Links shared on WhatsApp, LinkedIn or Slack show a title and an image. Without them you get a bare link that few people tap.

geo

More people now ask ChatGPT or Perplexity instead of searching. If their crawlers can't read your pages, you're never the answer.

speed

Google ranks slow pages lower, and people on a phone leave before a slow page has loaded.

schema

A schema that grew prompt by prompt has duplicate tables and missing links between them. Without migrations, changes can't be replayed safely on the live database.

backups

A backup nobody has restored is a hope, not a backup. AI agents have deleted live databases before; the restore is what saves the business.

serverupdates

New holes in old software are published every month, and bots try them on every server they find. Updates close them first.

domain

A preview link looks temporary and can change or vanish with the builder's plans. Without HTTPS, browsers mark your site as not secure.

exposed

A forgotten database panel or debug page can hand over your data and passwords. Scanners look for exactly these, all day long.

envkeys

Test keys in production mean payments that never arrive. Live keys in testing mean real charges and real emails from your experiments.

flows

These are the steps where customers and money come in. One broken step stops the whole funnel, often without an error anyone sees.

states

A blank screen looks like a dead app. People who see one rarely wait or try again; they leave.

leftovers

Placeholder text and fake numbers make a real product look like a demo, and can show test data to real customers.

a11y

About one person in six lives with a disability. Since June 2025, EU law also requires accessibility for many online shops and services.

deadcode

Unused code still gets read by your AI tool, and unused packages still bring their holes. It slows every prompt and muddles every fix.

bigfiles

A 2,000-line file is where AI edits go wrong: the tool loses track and breaks parts it didn't mean to touch. Small files keep changes small.

errors

An error that's caught and ignored leaves no trace. The user sees nothing happen, and you never learn why sales dropped.

tests

Without tests, every change is tested by your customers. A few tests on sign-up and payment catch the breakage first.

indexes

A query without an index reads the whole table every time. Fine with 100 rows, a frozen page with 100,000.

pagination

Loading every record at once works in testing and freezes phones in production. It can also send data the user shouldn't see.

loadtest

Launch day, a newsletter or a viral post brings everyone at once. Better to learn your limit from a test than from your users.

cdn

Heavy images and no caching make every visit slow and every visitor expensive. A CDN serves files from close to each user.

queues

A request that waits 30 seconds for an AI answer can time out and ties up the server. Background jobs keep the app quick.

quotas

Free plans pause projects, cap emails and throttle APIs. The limit tends to hit on your best day, when the most people are watching.

costs

Some setups cost more per user as they grow. Knowing the bill at ten times your users tells you whether your price still works.

Hover over a check to see why it matters. Tap a check to see why it matters. Prices in euro, VAT excluded. One-off, per app.