Every project submitted to Vibe96 goes through the same automated audit before a human ever looks at it. Last quarter, 214 of 1,498 submissions did not get past it. The reasons repeat with remarkable consistency, so it is worth being specific about what we look for.
Secrets and credentials
The single most common failure. API keys, database passwords and service tokens committed straight into source — usually in a .env file that was never added to .gitignore, or hardcoded in a config module during a late-night prompt session. We scan the full commit history, not just the current tree: a key removed in a later commit is still a key that shipped.
Authorisation and access control
AI tools are very good at building a route and very bad at remembering to guard it. We enumerate every endpoint and check whether an unauthenticated request, or a request from the wrong role, can reach data it should not. A permission hidden only in the UI is not a permission.
If the only thing stopping a customer from reading another customer's invoices is that the button is hidden, the application is not ready to sell.
Dependency vulnerabilities
Pinned versions are checked against known CVEs. We do not fail a listing for a low-severity advisory in a dev dependency, but an unpatched remote-code-execution path in a production package is an automatic rejection, with the file and version named in the report.
Database access rules
Injection surface, row-level security, and queries that forget to scope by tenant. Multi-tenant projects get extra attention here: one unscoped query in a shared table is a data breach waiting for the first serious customer.
Structure, documentation and build
The last three gates are about whether a buyer can actually work with the code. Can a developer read it? Is there a setup guide, an architecture note, an environment-variable list? And — the test that surprises the most sellers — does the project build and start on a clean machine using nothing but the README?
What happens after a rejection
Sellers get file-level findings and can resubmit as many times as they like. Roughly 60% of rejected projects come back and pass within a month. That, more than the pass rate, is the number we care about.