How to evaluate a vibe-coded app before you trust it

More tools ship every week now, built fast with AI by solo makers and small teams. A lot of them are genuinely good. Some are half-finished demos with a landing page. As someone trying them, you do not need to read the source — you need a quick way to tell which is which before you sign in, connect an account, or upload anything you care about.

Here is the checklist I run through. It takes about two minutes per tool.

Does the core thing actually work?

Skip the marketing copy and do the one job the tool exists for. A vibe-coded app is usually strong on its hero flow and thin everywhere else, so go straight at the main path:

• Run the primary action end to end, with real-ish input, not the pre-filled demo.
• Try one obvious edge case: empty input, a long paste, a weird character, hitting submit twice.
• Watch what happens when something is missing. Does it explain the problem, or just freeze or show a blank screen?

A tool that handles the happy path beautifully but white-screens on empty input is a demo, not a product. That is fine for a quick experiment; it is not fine for anything you depend on.

Who built it, and is anyone home?

You are trusting a stranger's code with your time and sometimes your data. A few seconds of context helps:

• Is there a name, a profile, or a way to contact the maker? Anonymous-and-unreachable is a yield sign, not a stop sign.
• Any signal it is maintained — a changelog, recent updates, a "last updated" date, replies to feedback?
• Does the page over-promise? "Revolutionary all-in-one platform" from a two-week-old project usually means the copy is ahead of the code.

What is it asking for, and why?

This is the part worth slowing down on. Match what the tool asks for against what it actually needs to do its job:

• Sign-in scope. A formatting tool that wants full access to your Google Drive is asking for more than its job requires. Be stingy with OAuth permissions.
• What you upload. Before you paste a client doc or a spreadsheet of real data, ask whether this tool needs the real thing or whether a sample proves the point.
• Where data goes. Single-file and local-first tools (a lot of Pocket Tools work this way) run in your browser and never send your data anywhere. That is the safest shape for anything sensitive.
• Payment. If it charges, is the pricing legible and the checkout a name you recognize (Stripe, Paddle)? Vague pricing plus a sketchy payment page is a hard pass.

You do not need to be paranoid. You need the ask to be proportional to the job.

Quick security gut-check

You will not audit anyone's code from the outside, but a few surface signals are easy to read:

• HTTPS. The address bar shows a lock, not "Not secure." Non-negotiable if you are typing anything in.
• No secrets in the URL or page. If you ever see an API key sitting in the page or a link, that is a real leak and a reason to leave.
• Permissions you can revoke. If you connected an account and change your mind, you can pull access from your Google/GitHub settings later. Know that escape hatch exists.

Decide what "good enough" means for this use

Not every tool needs to be production-grade. Match your bar to your use:

• Throwaway / one-off: does it work right now, on this one input? Ship-readiness does not matter.
• Repeat use in your workflow: now maintenance, reliability, and data handling matter.
• Anything with real or client data: apply the whole checklist, and prefer local-first tools.

A rough tool that nails one job is often more useful than a polished one that does ten things adequately. Judge it against what you actually need, not against an imaginary enterprise standard.

The two-minute version

1. Do the core job for real — and try one edge case.
2. Check there is a maker and signs of life.
3. Make sure the ask (permissions, data, payment) fits the job.
4. Lock + no exposed secrets.
5. Match your trust bar to your actual use.

The whole point of a discovery directory is to try things cheaply. This checklist keeps "cheap to try" from turning into "expensive to regret." Browse with it in the back of your mind and you can move fast without getting burned.

Ready to explore? Browse the directory of vibe-coded apps, or learn the vocabulary if any of the terms here were new.