Skip to content

Free PDF within 24 calendar hours

Request a free review

Free public app review

Get a second set of eyes on your app

Before customers rely on it, a senior engineer checks your app's public pages for exposed keys and files, missing browser security controls and layouts that break on a phone. Your PDF shows the evidence and what to fix first.

Request a free reviewSee an example finding

Your free PDF arrives within 24 calendar hours after we receive a working public URL.

We review public pages only. No login or source code is needed. Need code or logged in workflows reviewed? Ask about a private app review

For Australian app and platform owners. A public staging build or a live app is welcome.

"Every issue came with a practical fix, sequenced so we could ship safely, and they handed over their testing tools so the value outlasted the engagement."
Stacey BlackwellDirector, BuildScoreFrom a paid prelaunch reviewRead the full client feedback

Who reviews your app

JoshVibeZero founder

Josh's background covers IT infrastructure and software development, with experience across state government, enterprise and not for profit organisations.

What you receive

Every finding comes with evidence and a next step

Your PDF puts the most important findings first. Each one records what we observed, why it matters, the next action and what a public check cannot establish.

Public app reviewExample

Priority 1Security

Source maps publish the app's original code

Observed
The live app serves source map files. A browser can use them to rebuild the original source files and folder names.
Why it matters
Anyone can study how the app works, including admin pages and any key left in the code.
Next action
Stop publishing source maps from the production build, then check the published code for keys and tokens.
Limit
We can confirm the files are public. A public check cannot show whether anyone has used them.

This is an illustrative example, not a client result.

What this review covers

We check what a public visitor can reach

Use it before launch, after an update or when you want another engineer to look at the public part of an existing platform. We record priorities in the PDF so you can decide what deserves attention.

Checked in the free review

  • Visual clarity and responsive behaviour

    We work through the public pages at desktop and mobile widths, checking hierarchy, consistency, content clarity, layout breaks and the interaction states a visitor can reach.

  • Accessibility and form behaviour

    We check keyboard use, focus order, labels, contrast, semantic structure and public form and error states that do not require us to send data.

  • Loading and page performance

    We inspect page weight, loading behaviour, image delivery, render delays and other public signals that can make the app feel slow or unstable.

  • How public pages appear in search

    We inspect page titles, descriptions, indexing settings and structured data to see how your public pages describe themselves to search engines.

  • Public security controls

    We check HTTPS and TLS, browser headers, framing controls, public cookie settings, exposed files, source maps and credential patterns visible in public assets.

  • Visible technical issues

    We inspect public routes, browser code and error behaviour for clues about how the app is built. These checks cannot establish what happens in private systems.

Not checked without private access

  • The codebase, repository history and private dependencies
  • Logged in screens, account roles and authenticated workflows
  • Authenticated APIs, hosting and cloud infrastructure
  • Database, storage and server side permissions
  • Secrets, environment variables and private configuration
  • Business logic, payments and private data flows

The review stops where public access stops. We do not sign in, accept credentials or inspect a private repository. An area outside scope is not evidence that it is safe or unsafe. This review is not a penetration test or certification.

How it works

Send a URL and get a considered answer

The PDF is written and checked by an engineer. You can use it yourself, pass it to your developer or book the included optional 15 minute walkthrough after delivery.

  1. Send the public URL

    Use a public staging or live URL that opens without a login. Tell us what concerns you most if you want to.

  2. An engineer reviews the public pages

    A senior engineer uses external tools, checks the pages at desktop and mobile widths and reviews the evidence in context.

  3. Read the PDF and choose your next step

    We email your PDF within 24 calendar hours after receiving a working public URL. An optional 15 minute walkthrough is included after delivery.

SMB1001 Silver Level 2
VibeZero is CyberCert certified. This credential does not certify the app we review. About the certifier

Before you submit

What to know before you send the URL

Why is the review free?

The free review stays on public pages, so we can complete it within 24 calendar hours after receiving a working public URL. It gives you a useful first check and lets you see how we work. A deeper code or logged in audit is separate paid work if you need it. The PDF is yours either way.

Is it safe for a live application?

We make read only, non destructive requests to public pages and files. We do not sign in, enter data, submit forms, change data or attempt to exploit a finding.

What happens to the details I submit?

We use your name and company to manage the request, the URL to review the public app and your email to send the result and one possible follow up about the findings. We do not send these details or your concern text to analytics or advertising platforms. If Google supplied an advertising click identifier, we may store it with the request so we can measure the campaign. With your permission, we also store Meta advertising references with the request and send Meta a confirmed request event without your submitted details. We do not add you to a marketing list.

Can you review an app behind a login?

Yes, we can review the pages that open publicly, even if other parts of the app require a login. The free review stops where public access stops. If you need logged in workflows or code reviewed, ask about a separate paid app review. We do not ask for credentials through this form or treat private areas as checked.

Do I need to buy anything after the review?

No. The free PDF stands on its own. If you want us to inspect code, authenticated workflows or private infrastructure, we can scope a separate paid review after delivery. You decide whether that work happens.

More questions
Who performs the review?

A senior VibeZero engineer runs the external tools, reviews the public app at desktop and mobile widths, checks the evidence and writes the PDF. The result is not an unreviewed scanner export.

Does the app need to have been built with AI?

No. You can request a free review of a conventionally built app or one built with tools such as Cursor, Lovable, Replit, Bolt, v0, Base44 or Claude Code. It can be a public staging build, a live app or the public pages of an existing platform.

What if the URL cannot be reached?

We will email you and ask for a working public URL. The 24 calendar hour delivery period starts once we receive a URL that opens without a login, password or private preview token.

Does 24 hours mean calendar hours?

Yes, including weekends. The PDF is due within 24 calendar hours after a successful request with a working public URL. If we cannot honour that window, we will pause new requests rather than promise a delivery time we cannot meet.

Can I go straight to a private app review?

Yes. If you already need codebase, logged in workflow or private infrastructure testing, you can ask for a private app review without requesting the free public app review first.

Is this a penetration test or certification?

No. It is an external review of the unauthenticated public surface. It does not certify the app, codebase, logged in workflows or private infrastructure.

Before your next launch or update

Let another engineer take a look

Request a free review

The PDF arrives within 24 calendar hours after we receive a working public URL. There is no obligation to continue.