‹ ShowingBookQuality report QR-26-00122
ShowingBook
Real estate CRM and viewing calendar for independent agents and small teams, with admin-managed accounts.
- Product ID
- B0549-98806
- Builder
- Raj's Builder Studio
- Version reviewed
- 1.0.0 · released 12 Nov 2026
- Stack
- Express 4 (API); front end is vanilla JS with no framework · JavaScript (Node.js 22.13+, ES modules in the browser) · SQLite via Node built-in node:sqlite (requires Node 22.13+)
- Built with
- OpenAI Codex, Claude Code
- Review period
- 3 Nov 2026 – 12 Nov 2026 · 2 rounds of changes
- ✓AI code audit6 checks · 3 Nov 2026
- ✓Installed & run12 Nov 2026
- ✓Demo vs delivered12 Nov 2026
- ✓Final sign-off12 Nov 2026
At a glance
- !Installed and run from the delivered code — 7 of 8 checks answered yes.
- ✓Live demo compared with the delivered code — 7 of 7 checks answered yes.
- !10 of 15 promised items delivered (setup guide, example config and the rest).
- ✓Security scored 87/100 with no failing check.
- !3 open warnings — explained in part 1.
AI code audit
The full source archive was read by our AI auditor against each check. It reads the code — it does not run it; running it is part 2.
| Check | What we found | Score | Result |
|---|---|---|---|
| Secrets & credentials | The regex candidates are all code references (config reads, JWT signing calls, test logins), not committed secrets. .env.example uses a clear placeholder for JWT_SECRET, and the first-admin credentials are empty. The one concern is a known demo password that ships in seed.sql and is used by the live demo, with a SEED_DEMO flag that could load it on a real install. | 88 | Warning |
| Dependency vulnerabilities | The only manifest is a project file with a committed package-lock.json, and the Dockerfile installs with `npm ci`. Versions look current (Express 4.x, helmet 8, jsonwebtoken 9, bcryptjs 3, express-rate-limit 8) with no known critical advisories. Minor issues: caret ranges rather than exact pins, Express 4 is in maintenance mode, and the lockfile contents could not be inspected. | 88 | Pass |
| Authorisation & access control | Every data route except login and health goes through requireAuth, which reloads the user from the DB. Admin routes sit behind requireRole('admin'), and all client, listing, viewing and task lookups filter by owner_id. Passwords are bcrypt-hashed. Remaining gaps are small: stale tokens after a password change, and a missing ownership check on a PUT that changes the owner of a linked client. | 93 | Pass |
| Database access rules | All reviewed queries use bound parameters, and per-user reads, updates and deletes filter on owner_id. The one dynamic SQL path (owned.js) takes table and column names only from code constants. a project file was not in the excerpts, so foreign keys, cascades and indexes could not be confirmed, and a few points need attention. | 80 | Warning |
| Code structure & duplication | The server is organised into focused modules (routes, middleware, validators, generic owner-scoped CRUD in owned.js), and files are small. The main weaknesses are repeated bcrypt/rate-limit setup, a CORS header block inlined in app.js, and a few hard-coded limits and literals that belong in config. | 88 | Pass |
| Build reproducibility | Manifests, lockfile, Dockerfile and compose are coherent: node 22 base matches engines >=22.13, build context and COPY paths resolve, and dev deps are omitted in production. Gaps: HowToSetup.md was not in the digest so prerequisites and step order could not be verified, and the quick start's .env location plus the production defaults could trip a clean install. | 80 | Warning |
Open warnings
Problems that did not stop the listing. They stay on the product page until a later version fixes them.
The regex candidates are all code references (config reads, JWT signing calls, test logins), not committed secrets. .env.example uses a clear placeholder for JWT_SECRET, and the first-admin credentials are empty. The one concern is a known demo password that ships in seed.sql and is used by the live demo, with a SEED_DEMO flag that could load it on a real install.
Manifests, lockfile, Dockerfile and compose are coherent: node 22 base matches engines >=22.13, build context and COPY paths resolve, and dev deps are omitted in production. Gaps: HowToSetup.md was not in the digest so prerequisites and step order could not be verified, and the quick start's .env location plus the production defaults could trip a clean install.
All reviewed queries use bound parameters, and per-user reads, updates and deletes filter on owner_id. The one dynamic SQL path (owned.js) takes table and column names only from code constants. a project file was not in the excerpts, so foreign keys, cascades and indexes could not be confirmed, and a few points need attention.
Requirement list
What the builder agreed to deliver before uploading — 10 of 15 met.
- Complete source for every component Partial
- No real credentials in the archive Met
- Builds from a clean machine Partial
- Database script or migrations Met
- Authentication and roles on every mutating endpoint Partial
- Pinned dependencies without critical CVEs (nice)Partial
- Documentation set (nice)Met
- Working live demo Partial
- README.md Met
- HowToSetup.md Met
- CLAUDE.md (or AGENTS.md) (nice)Met
- CHANGELOG.md (nice)Met
- .env.example Met
- a project file Met
- a project file (nice)Met
Human review
Reviewers from the Vibe96 team in Dubai worked through each question below; a final reviewer signed it off.
Stage 1 — Installed and run from the delivered code
Completed 12 Nov 2026A reviewer installed the product on a clean machine, following only the guide that ships with it.
| Question | Answer | Reviewer's note |
|---|---|---|
| Packages restored without errors | Yes | |
| Solution builds clean | Yes | |
| Database created from the shipped script or migrations | Yes | |
| First sign-in works with the documented steps | Yes | |
| Setup guide is accurate and complete | Yes | |
| Every module in the feature list opens and works | Yes | |
| No real secrets in the archive | Yes | |
| Branding and company details can be changed without code | No |
Stage 2 — Live demo compared with the delivered code
Completed 12 Nov 2026A second reviewer checked that what the listing and demo show is what the buyer receives.
| Question | Answer | Reviewer's note |
|---|---|---|
| Demo URL is reachable | Yes | |
| Demo credentials work | Yes | |
| Demo runs the same version as the archive | Yes | |
| All five differentiators are visible in the demo | Yes | |
| Screenshots match the demo | Yes | |
| Nothing in the demo is missing from the code | Yes | |
| Datasheet claims are accurate | Yes |
Changes asked for during review
- None — approved on the first round.
- Sign-off: approved for sale on 12 Nov 2026 with 3 warnings shown publicly.
What this report covers — and what it doesn't
- It covers version 1.0.0 exactly as the buyer downloads it: the source archive, the setup guide and the live demo on the dates above.
- It is not a penetration test, a performance or load test, or a legal review of third-party package licences.
- Scores are a point in time. Libraries age; a later version is audited again and gets its own report.
- Your setup matters. Hosting, configuration and changes made after purchase are outside this review.
- How the score is made: each AI check is scored 0–100 and weighted (security counts most). A listing needs 75 or more, no failing check, and the human review passed.
- Always try the live demo before buying, and ask the builder questions from the product page.
Vibe96 FZ-LLC, Dubai, UAE. This report describes the product at the time of review and is not a warranty.