Vibe-coded software works right up until someone else depends on it. If you are about to deliver an AI-built app to a client, or accept one, an audit is the reasonable instinct. This page covers what auditing vibe code actually involves, what the market charges for it, and which part of it you can have executed and signed for £19 instead of quoted in the thousands.
The pattern behind every audit request is the same: the code was written faster than it was reviewed. An agent produced thousands of lines while the human steered by outcome, which is a perfectly productive way to build and a terrible basis for a warranty. When the project changes hands, somebody finally asks the questions nobody asked during the build. Does it actually run from a clean environment? Do the tests pass, and do they test anything? Are there credentials in the history? Does the README describe this codebase or an earlier dream of it? Which of the agent’s confident claims are true?
Those questions split into two kinds, and the split matters, because they are priced and answered completely differently.
Judgement questions need a skilled human: is this architecture sensible, is the code maintainable, are there subtle security holes. Human audit services answer these, typically at $199 to $3,000 per audit with a several-day turnaround, and a good one is worth it when the stakes justify the price. What they hand back is an expert’s opinion, and its value depends entirely on whose opinion it is.
Evidence questions have executable answers: does it build, do the checks pass, does the delivered code match what the documentation describes, are the setup steps real, which claims does the repository actually support. These do not need an expert. They need execution in a clean environment and honest labelling of the results, and paying a consultant day rates to run npm install is how most audit budgets actually get spent.
Mantyl automates the evidence half. The free CLI reads the repository and the coding-agent history behind it, executes install, build and tests in an isolated Docker sandbox, and produces a project passport where every statement is labelled by how it was established. Claims the agent made that the code does not support are marked contradicted, with the evidence named. Undocumented environment variables, unfinished work and untested paths surface as risks instead of surprises.
That run is free, local, and uploads nothing. For the moment the result has to convince someone who does not trust the builder, Mantyl Verified re-executes every recorded check on infrastructure the builder does not control and signs the outcome. One-off, £19 to £49 by project size, refundable until the run executes, and a run that finds failures includes a free re-run within 14 days so fixing the findings costs nothing extra. The recipient can re-check the whole passport themselves with one command, which no PDF report from any audit service can offer.
A Mantyl verification is not a security audit and not a code review. It proves the recorded checks reproduce against exactly the delivered source, and it surfaces contradictions between claims and evidence. It does not judge whether the architecture is wise or hunt for vulnerabilities, and anyone who sells you executed checks as a security guarantee is doing you a disservice. If the project handles money, personal data or anything regulated, buy the human audit as well, and hand the auditor the passport first: they will spend their expensive hours on judgement instead of setup archaeology.
Delivering vibe-coded work to a client: run the free CLI before you send anything, fix what it surfaces, and deliver the passport with the project. The full process is in the AI code handover guide and the handover checklist. Receiving or buying one: ask for a passport, or run the recipient check yourself on what you were sent. Rescuing one that already shipped broken: read before you hire someone to fix your AI-built app first, because a £19 verification that names what is actually broken is the cheapest thing you will buy this quarter, and it makes the four-figure engagement you might still need dramatically better aimed.