What a cleanup job actually contains
The security layer comes first, because it's the part with a clock on it. Committed keys, string-built SQL, debug mode left on in production, wildcard CORS, a .env file sitting in the repo. A key in git history stays there after you delete the file, so rotation has to happen before anything else gets touched.
Then the structural work: no tests, no error handling, business logic pasted across four files, dependencies pinned to "latest" or not pinned at all. That work is slower but less urgent. Sequencing matters here, and most cleanup jobs go wrong by starting with the tidy refactor while a live key sits in the history.
Triage before you quote
A scan gives you the inventory: what's wrong, where it is, how severe it is, and what fixing it involves. secure·vibes takes a public GitHub repo link and returns a 0–100 score with a letter grade, six weighted category subscores, and a ranked findings list with file, line, redacted evidence, why it matters, and how to fix it. Typically under a minute, nothing cloned to disk.
For someone quoting the work, that inventory is the difference between a number pulled from the air and a scope you can defend. For a founder hiring, running it yourself first means you walk into the conversation knowing whether you're buying two days of key rotation or a month of restructuring.
Fixes that fit the way the app was built
Each finding comes back with a ready-to-paste prompt for Claude Code or any coding agent, plus one prompt that addresses everything at once. The tooling that produced the code can close most of the findings, which keeps the cheap fixes cheap and leaves the specialist's time for the parts that need judgement.
Worth knowing where the line sits: secure·vibes runs pattern-based static checks. It doesn't execute your code, doesn't consult a vulnerability database, and isn't a penetration test. It's triage, and triage is the step that tells you how big the job is.
Sequencing a cleanup: what goes first, and why
| Stage | Work | Why this order |
|---|---|---|
| 1 | Rotate exposed credentials | Deleting the file doesn't clear git history; the key stays live until rotated |
| 2 | Injection and unsafe code paths | Exploitable today, and usually a small number of specific lines |
| 3 | Auth, access rules, debug flags | Cheap to fix, and each one is a door left open |
| 4 | Dependencies and lockfiles | Lower urgency, but blocks safe upgrades later |
| 5 | Tests, structure, error handling | The expensive part — worth scoping only once the above is known |
frequently asked
Is vibe coding cleanup a real job or an internet joke?
Both, in that order. The phrase spread as a prediction and the work turned out to exist: apps built fast, shipped to real users, then handed to someone else to make maintainable. It looks like contract remediation work rather than a job title anyone puts on a business card.
How do I scope a cleanup without reading the whole codebase?
Scan it first. A ranked findings list with severities and file locations gives you the shape of the job in minutes, which is enough to decide whether you're quoting days or weeks and where the risk sits.
Should the app be fixed or rebuilt?
Findings volume alone won't answer that, but it narrows it fast. A short list of specific issues in an app that works is a fix. Problems spread across every file, with no tests to catch what you break, is where rebuilding starts to look cheaper.
What does the scan cost?
Two free scans on Claude Haiku, no card, with nothing held back. After that it's $5 a scan, singly or in packs of 3 or 10, running Claude Opus 5 over the whole repo, or Claude Fable 5 if you want the strongest model on it. No subscription, nothing expires, and a scan that fails costs nothing.
Last updated August 11, 2026