CodeDR.AI

Your app works. Is it ready? Nine diagnostic skills for Cursor and Claude Code. Repo stays on your machine.

[CodeDR.AI @codedrai]

Taught a Grok bot to audit code. Gave it a repo it had never seen. 13 minutes later: Testing F. Deploy D. Code quality C. Security B.

Plus a fix plan for this week, this month and this quarter. Nothing pushed to your repo.

Sped up to 60 sec. The https://t.co/4wIT9819Is skill pack works in Grok, Claude Code and Cursor: https://t.co/H9GOttU6pa #Grok #xai

[CodeDR.AI @codedrai]

Your AI wrote forty features and zero tests. The first refactor quietly breaks checkout and nobody notices for a week. Free guide to vibe coding without that: https://t.co/luFRLopoD6

[CodeDR.AI @codedrai]

Ten test users and it flies. A thousand real ones and every page waits on a 4MB bundle and an unindexed query. Exam performance before launch. $49.95: https://t.co/DO81jjpjqE

[CodeDR.AI @codedrai]

Aisevak - Overall grade: B-.
Structure B | Security C+ | Testing B | Deploy B- | Quality C+ | Performance B- | Architecture B+
Scoped agent tokens + argon2, solid. Gap: https://t.co/5oZBzgX5Xf leaves :8080 public and the first visitor to onboarding becomes owner (server.ts:688), with full host access.

[CodeDR.AI @codedrai]

Nice job @0xzi11a - Inboxed - Overall grade: A-.
Structure A- | Security A- | Testing B+ | Deploy C+ | Quality A- | Performance B | Architecture A-
Mail HTML gets a no-script sandbox + its own CSP, images off till asked (HtmlBody.svelte:126). Rare care. Nit: the app window runs csp: null (tauri.conf.json:37).

[CodeDR.AI @codedrai]

RAPR AI - Overall grade: B-.
Structure B- | Security C | Testing B+ | Deploy B | Quality C+ | Performance B- | Architecture B
PIN + lockout work is solid. But /static mounts the project root with no auth (https://t.co/ua55jUXYi3). From source, that's where .env, .vault_key and the db live.

[CodeDR.AI @codedrai]

@theturukx Oops - Overall grade: A-.
Structure A- | Security B+ | Testing B | Deploy B+ | Quality B+ | Performance B | Architecture A-
Store outside the repo, smart. Gap: Bash commands mentioning oops.js skip the snapshot (core.js:78), so "oops.js log && rm -rf src" isn't fully undoable.

[CodeDR.AI @codedrai]

ChatVault - Overall grade: B-.
Structure B | Security C+ | Testing D | Deploy B- | Quality B- | Performance B+ | Architecture B
Path guard's solid. But send_message is on IPC with no UI caller and runs claude --dangerously-skip-permissions hidden (https://t.co/ucoCTk9MO0). I'd drop it.

[CodeDR.AI @codedrai]

Well done! @fetijashari - flowreel - Overall grade: A.
Structure A- | Security A | Testing A | Deploy A | Quality A- | Performance A- | Architecture A
Mail guard runs before any request and the seam gate checks loopback + JSON body, real rails. Only nit: Graph fetch has no timeout (graph.ts:580).

[CodeDR.AI @codedrai]

@Gl0deanR hello-stack - Overall grade: B.
Security B-, Tests F, Deploy B+, Quality B+, Perf A-, Structure A-.
Sharp: https://t.co/eL07bI9OZH rotates SECRET_KEY but leaves POSTGRES_PASSWORD=app and pgAdmin admin/admin (.env.example + https://t.co/eL07bI9OZH).

[CodeDR.AI @codedrai]

@marclou naga-studio - Overall grade: B+.
Sec A-, Tests F, Deploy C, Quality B+, Perf A-, Structure A-
Strength: per-device HID attribution, so only the Naga gets rewritten (event-engine.swift:127). No network code at all.

[CodeDR.AI @codedrai]

@matchaman11 open-dots - Overall grade: C-. Structure B+, Security D, Testing B+, Deploy C+, Quality B+, Perf B+, Arch B. Strength: ~318 tests, zero any/TODO, encrypted creds, locked-down local path. But POST /tasks trusts client user_id+box_id, loading another user's tokens into your box.

[CodeDR.AI @codedrai]

vibe-work - Overall grade: A-. NICE WORK!
Structure A | Security A | Testing B- | Deploy A- | Quality A | Perf A- | Arch A
Strength: Mistral key never reaches the agent. Vibe gets a placeholder, a loopback proxy swaps in the real key. Gap: SSRF guard vw-netguard/src/ip.rs:61 has no tests.

[CodeDR.AI @codedrai]

@ghidalgodesign usability-test-mcp - Overall grade: A-.
Structure A | Security A- | Testing A- | Deploy B+ | Quality A | Performance A- | Architecture A
Browser safety: default-deny + redirect re-checks (driver.ts:59-94). Gap: image fetch follows redirects, no private-IP deny (store.ts:54).

[CodeDR.AI @codedrai]

@AkashManna17049 Insomnia - Overall grade: B.
Structure B- | Security B+ | Testing F | Deploy B | Quality B+ | Performance A- | Architecture B
Strength: root helper allowlists ops and timer seconds; gen markers stop stale jobs from clobbering a newer session (helper/insomnia-helper:58-84).

[CodeDR.AI @codedrai]

@wchengphy Waymark - Overall grade: B+.
Structure A- | Security A- | Testing B | Deploy B | Quality B+ | Performance B | Architecture A-
Local claim holds: zero deps, no backend. Fix: a bad data.json decodes to an empty library, then the next save overwrites it (DataStore load, line 63).

[CodeDR.AI @codedrai]

@deeponailabs agent-vault - Overall grade: A-.
Structure A | Security B+ | Testing A- | Deploy B | Quality A- | Performance A- | Architecture A
MCP path is tight. Gap: run injects any secret into any command, no allow list (https://t.co/hPefrW1MMY). A per-secret run opt-in would close it.

[CodeDR.AI @codedrai]

It runs. Then every edit feels risky because nothing was linted, typed, or cleaned up. Exam code quality before the mess hardens. https://t.co/LUqtGpnJFh

[CodeDR.AI @codedrai]

Vibe coding stacks features fast. Then you get folder soup, circular imports, and one file that owns everything. Exam structure before that becomes the product. https://t.co/LUqtGpnJFh

[CodeDR.AI @codedrai]

Works on localhost. Then prod has no health check, no env vars set, and no way to roll back. Exam deploy readiness before launch day. https://t.co/LUqtGpnJFh

[CodeDR.AI @codedrai]

@NihonFemStyle it’s OK man you don’t have to care. it’s public so I am grading it.. :)