Ten test users and it flies. A thousand real ones and every page waits on a 4MB bundle and an unindexed query. Exam performance before launch. $49.95: buy.stripe.com/3cIfZg7jcf2Og…
Aisevak - Overall grade: B-.
Structure B | Security C+ | Testing B | Deploy B- | Quality C+ | Performance B- | Architecture B+
Scoped agent tokens + argon2, solid. Gap: install.sh leaves :8080 public and the first visitor to onboarding becomes owner (server.ts:688), with full host access.
Nice job @0xzi11a - Inboxed - Overall grade: A-.
Structure A- | Security A- | Testing B+ | Deploy C+ | Quality A- | Performance B | Architecture A-
Mail HTML gets a no-script sandbox + its own CSP, images off till asked (HtmlBody.svelte:126). Rare care. Nit: the app window runs csp: null (tauri.conf.json:37).
Oops - Overall grade: A-.
Structure A- | Security B+ | Testing B | Deploy B+ | Quality B+ | Performance B | Architecture A-
Store outside the repo, smart. Gap: Bash commands mentioning oops.js skip the snapshot (core.js:78), so "oops.js log && rm -rf src" isn't fully undoable.
ChatVault - Overall grade: B-.
Structure B | Security C+ | Testing D | Deploy B- | Quality B- | Performance B+ | Architecture B
Path guard's solid. But send_message is on IPC with no UI caller and runs claude --dangerously-skip-permissions hidden (lib.rs:308). I'd drop it.
Well done! @fetijashari - flowreel - Overall grade: A.
Structure A- | Security A | Testing A | Deploy A | Quality A- | Performance A- | Architecture A
Mail guard runs before any request and the seam gate checks loopback + JSON body, real rails. Only nit: Graph fetch has no timeout (graph.ts:580).
naga-studio - Overall grade: B+.
Sec A-, Tests F, Deploy C, Quality B+, Perf A-, Structure A-
Strength: per-device HID attribution, so only the Naga gets rewritten (event-engine.swift:127). No network code at all.
open-dots - Overall grade: C-. Structure B+, Security D, Testing B+, Deploy C+, Quality B+, Perf B+, Arch B. Strength: ~318 tests, zero any/TODO, encrypted creds, locked-down local path. But POST /tasks trusts client user_id+box_id, loading another user's tokens into your box.
vibe-work - Overall grade: A-. NICE WORK!
Structure A | Security A | Testing B- | Deploy A- | Quality A | Perf A- | Arch A
Strength: Mistral key never reaches the agent. Vibe gets a placeholder, a loopback proxy swaps in the real key. Gap: SSRF guard vw-netguard/src/ip.rs:61 has no tests.
usability-test-mcp - Overall grade: A-.
Structure A | Security A- | Testing A- | Deploy B+ | Quality A | Performance A- | Architecture A
Browser safety: default-deny + redirect re-checks (driver.ts:59-94). Gap: image fetch follows redirects, no private-IP deny (store.ts:54).
Insomnia - Overall grade: B.
Structure B- | Security B+ | Testing F | Deploy B | Quality B+ | Performance A- | Architecture B
Strength: root helper allowlists ops and timer seconds; gen markers stop stale jobs from clobbering a newer session (helper/insomnia-helper:58-84).
Waymark - Overall grade: B+.
Structure A- | Security A- | Testing B | Deploy B | Quality B+ | Performance B | Architecture A-
Local claim holds: zero deps, no backend. Fix: a bad data.json decodes to an empty library, then the next save overwrites it (DataStore load, line 63).
agent-vault - Overall grade: A-.
Structure A | Security B+ | Testing A- | Deploy B | Quality A- | Performance A- | Architecture A
MCP path is tight. Gap: run injects any secret into any command, no allow list (runner.py:53). A per-secret run opt-in would close it.
It runs. Then every edit feels risky because nothing was linted, typed, or cleaned up. Exam code quality before the mess hardens. codedr.ai
Vibe coding stacks features fast. Then you get folder soup, circular imports, and one file that owns everything. Exam structure before that becomes the product. codedr.ai
Works on localhost. Then prod has no health check, no env vars set, and no way to roll back. Exam deploy readiness before launch day. codedr.ai
It runs. An API key in the client bundle still sits between you and launch. Exam secrets before you ship. codedr.ai