‹ ApparelOS - Garment Factory Management ERPQuality report QR-26-00090
ApparelOS - Garment Factory Management ERP
Self-hosted Laravel ERP for garment factories: orders, production, inventory, HR/payroll, accounts, commercial.
- Product ID
- B0365-58871
- Builder
- NexStep Digital
- Version reviewed
- 1.0.0 · released 4 Nov 2026
- Stack
- Laravel 13 (laravel/framework ~13.37) · PHP 8.3 · MySQL 8
- Built with
- Claude Code
- Review period
- 29 Oct 2026 – 4 Nov 2026 · 1 round of changes
- ✓AI code audit6 checks · 29 Oct 2026
- ✓Installed & run2 Nov 2026
- ✓Demo vs delivered4 Nov 2026
- ✓Final sign-off4 Nov 2026
At a glance
- !Installed and run from the delivered code — 7 of 8 checks answered yes.
- ✓Live demo compared with the delivered code — 7 of 7 checks answered yes.
- !12 of 15 promised items delivered (setup guide, example config and the rest).
- !Security scored 69/100 with no failing check.
- !5 open warnings — explained in part 1.
AI code audit
The full source archive was read by our AI auditor against each check. It reads the code — it does not run it; running it is part 2.
| Check | What we found | Score | Result |
|---|---|---|---|
| Secrets & credentials | None of the regex candidates is a real secret: the scripts generate random passwords at install time, and .env.example ships DB_PASSWORD and ADMIN_PASSWORD empty. The only issue is a docker-compose.yml that ships a predictable DB password (apparelos), which buyers may deploy unchanged. | 88 | Warning |
| Dependency vulnerabilities | The only manifest is composer.json with a committed composer.lock (229 KB), so installs are reproducible. Laravel is pinned to a tilde patch range (~13.37.0) and PHP to ~8.3.0, with no wildcard or dev-stage requirements. I could not inspect the lock contents, so the transitive package versions are unverified; a few loose ranges and unneeded build assumptions remain. | 82 | Pass |
| Authorisation & access control | Most visible Accounts controller actions call canAccess('accounts'), and passwords use Laravel's hashed auth. However several actions (create/edit/update/destroy in ExpenseController, destroy in FixedAssetController and GlAccountController) show no inline guard, and a project file with its middleware was not provided, so route-level protection cannot be verified. | 58 | Warning |
| Database access rules | The visible controllers use Eloquent with validation, and there is no string-built SQL or unscoped delete in the excerpts. The digest ended before any migrations, models or the 61 migration files were shown, so foreign keys, indexes, and sensitive-column storage could not be verified. Some N+1 and in-memory aggregation patterns are visible in the accounts code. | 62 | Warning |
| Code structure & duplication | The project is split into sensible resource controllers, models, and per-module view folders, which makes it navigable. However, several controllers mix validation, posting logic and analytics in single methods, and the route layout is organised by development phase rather than by module, which will hurt long-term maintenance. | 78 | Warning |
| Build reproducibility | composer.json, .env.example, setup scripts and composer.lock are present and coherent, and the setup script runs install, env, key, migrate and seed in a sensible order. Gaps: a very tight Laravel 13.37 pin on PHP ~8.3, the HowToSetup.md content was not visible, and the Docker compose credentials and agent bootstrap files add noise. | 78 | Warning |
Open warnings
Problems that did not stop the listing. They stay on the product page until a later version fixes them.
None of the regex candidates is a real secret: the scripts generate random passwords at install time, and .env.example ships DB_PASSWORD and ADMIN_PASSWORD empty. The only issue is a docker-compose.yml that ships a predictable DB password (apparelos), which buyers may deploy unchanged.
The project is split into sensible resource controllers, models, and per-module view folders, which makes it navigable. However, several controllers mix validation, posting logic and analytics in single methods, and the route layout is organised by development phase rather than by module, which will hurt long-term maintenance.
The visible controllers use Eloquent with validation, and there is no string-built SQL or unscoped delete in the excerpts. The digest ended before any migrations, models or the 61 migration files were shown, so foreign keys, indexes, and sensitive-column storage could not be verified. Some N+1 and in-memory aggregation patterns are visible in the accounts code.
composer.json, .env.example, setup scripts and composer.lock are present and coherent, and the setup script runs install, env, key, migrate and seed in a sensible order. Gaps: a very tight Laravel 13.37 pin on PHP ~8.3, the HowToSetup.md content was not visible, and the Docker compose credentials and agent bootstrap files add noise.
Most visible Accounts controller actions call canAccess('accounts'), and passwords use Laravel's hashed auth. However several actions (create/edit/update/destroy in ExpenseController, destroy in FixedAssetController and GlAccountController) show no inline guard, and a project file with its middleware was not provided, so route-level protection cannot be verified.
Requirement list
What the builder agreed to deliver before uploading — 12 of 15 met.
- Complete source for every component Met
- No real credentials in the archive Met
- Builds from a clean machine Met
- Database script or migrations Met
- Authentication and roles on every mutating endpoint Partial
- Pinned dependencies without critical CVEs (nice)Partial
- Documentation set (nice)Met
- Working live demo Partial
- README.md Met
- HowToSetup.md Met
- CLAUDE.md (or AGENTS.md) (nice)Met
- CHANGELOG.md (nice)Met
- .env.example Met
- a project file Met
- a project file (nice)Met
Human review
Reviewers from the Vibe96 team in Dubai worked through each question below; a final reviewer signed it off.
Stage 1 — Installed and run from the delivered code
Completed 2 Nov 2026A reviewer installed the product on a clean machine, following only the guide that ships with it.
| Question | Answer | Reviewer's note |
|---|---|---|
| Packages restored without errors | Yes | |
| Solution builds clean | Yes | |
| Database created from the shipped script or migrations | Yes | |
| First sign-in works with the documented steps | Yes | |
| Setup guide is accurate and complete | Yes | |
| Every module in the feature list opens and works | Yes | |
| No real secrets in the archive | Yes | |
| Branding and company details can be changed without code | No |
Stage 2 — Live demo compared with the delivered code
Completed 4 Nov 2026A second reviewer checked that what the listing and demo show is what the buyer receives.
| Question | Answer | Reviewer's note |
|---|---|---|
| Demo URL is reachable | Yes | |
| Demo credentials work | Yes | |
| Demo runs the same version as the archive | Yes | |
| All five differentiators are visible in the demo | Yes | |
| Screenshots match the demo | Yes | |
| Nothing in the demo is missing from the code | Yes | |
| Datasheet claims are accurate | Yes |
Changes asked for during review
- Round 1: changes requested on 30 Oct 2026; the builder fixed them and uploaded again.
- Sign-off: approved for sale on 4 Nov 2026 with 5 warnings shown publicly.
What this report covers — and what it doesn't
- It covers version 1.0.0 exactly as the buyer downloads it: the source archive, the setup guide and the live demo on the dates above.
- It is not a penetration test, a performance or load test, or a legal review of third-party package licences.
- Scores are a point in time. Libraries age; a later version is audited again and gets its own report.
- Your setup matters. Hosting, configuration and changes made after purchase are outside this review.
- How the score is made: each AI check is scored 0–100 and weighted (security counts most). A listing needs 75 or more, no failing check, and the human review passed.
- Always try the live demo before buying, and ask the builder questions from the product page.
Vibe96 FZ-LLC, Dubai, UAE. This report describes the product at the time of review and is not a warranty.