You had an app built with AI — or inherited one
Read what owning it costs before you ship it.
Paste the repository. Forge reads it for the things that decide whether it is safe to own — credentials in the source, keys shipped to the browser, tables anyone can read, a handover with no tests — and says what it could not see. Counts, never a grade, and never a rewrite pitch.
Try one:
No account, no score out of ten. Private repo? npx @ambera/review-tax read runs the full read on your own machine — nothing is uploaded.
What it looks for first
The failures that take vibe-coded apps down.
Each is read from the source, the migrations, the lockfile or the workflow text — deterministically, so the same repository always reads the same. Severity is fixed by the type of finding, never inflated for your repository.
Credentials written into the source
A key that is in the repository is in every clone of its history. The read matches provider key formats and high-entropy assignments — and never a placeholder, so a documented example key is not a finding.
Secrets shipped to the browser
A variable behind a public bundler prefix — NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_ — whose own name says service role, secret or private key. The prefix is a contract: it is downloaded by every visitor.
Tables without row-level security
Where the browser talks to the database directly, a table created without row-level security lets any visitor read rows that are not theirs. Asked only where a browser database client is a dependency — a server-side app is correct to have none.
Dependencies that were never installed
A package declared in the manifest that the lockfile does not resolve is the shape a hallucinated dependency takes — the next install rewrites the lockfile, and fails outright on a name no registry holds.
A handover with nothing to change against
Whether tests exist, whether anything was ever reviewed by a second person, whether the intent is written down. Five signals, each present, absent or honestly unknown — a count, never a grade.
The pipeline it ships through
Third-party actions pinned to a mutable tag, a workflow that runs fork code with the repository’s secrets, a container that runs as root from an untagged image. Read from the workflow and Dockerfile text.
Every detector was run against Forge’s own repository before it shipped, and the method — including where the read is wrong — is published at forge.ambera.app/methodology.
Then fix the worst of it
One repository, 90 days, $69 once.
The free read tells you where it stands. The Launch Audit connects the private repository, reads every file, files the fixes where your team already works, and re-reads nightly so you can see whether they moved anything — then it ends. Not a subscription.
Launch price — $99 after. Sign in with GitHub, connect the one repository, and the first reading runs on its own.
- Does it matter which tool built the app?
- No. Forge reads the repository, not the tool. Lovable, Bolt, Replit, v0, Cursor, Claude Code or a contractor — the read runs the same deterministic detectors over the same files, so two apps that differ only in who typed them read the same.
- The repository is private. What can I do without paying?
- Run the whole code read on your own machine: npx @ambera/review-tax read. It walks the files git tracks, prints the reading, and sends nothing anywhere — no account, no upload. The free hosted read covers any public repository.
- Will it tell me whether the app is good?
- It will not, and no honest instrument would. Every finding is a count over a stated sample, with the files to open and a machine-checkable criterion for what would clear it. Severity is a fixed property of the finding type — a credential in source is urgent in every repository — and red appears only there. The conclusion is yours.
- What does the $69 Launch Audit add?
- It connects one private repository for 90 days: the deep read over every source file, workflow, lockfile and agent instruction; every finding as a card with what the numbers add up to in sentences; the fixes filed into Linear, Jira, GitHub Issues or ClickUp; nightly re-reads that grade whether the fixes moved anything; and a closing report when the window ends. Once, not a subscription — $99 after the launch price.
- Can I hand the result to someone who cannot read code?
- Yes. A reading composes into a document with its own coverage section — what was read, and what that leaves unanswered — shared by a link you can revoke, or printed. It says what it measured, which is why a sceptical engineer can check it and a non-technical owner can act on it.