Run three checks before you hand a vibe-coded codebase to a dev shop: scan git history for committed secrets, run a dependency audit for stale or unmaintained packages, and pull a real test-coverage number. Ten minutes with an AI code-review tool catches most of it; a shop's paid audit ($3,000-$15,000) catches the rest. Skip the free pass and you pay the shop to discover it instead.
Founders showing up to a dev shop in 2026 look different than they did two years ago. They're not carrying a Figma file and a pitch deck — they're carrying a repo, usually built start to finish with an AI coding agent, usually with real users already on it. The shop's first question isn't "can we build this," it's "what's actually in here." Answering that yourself first, even roughly, changes the quote you get and how much ground you walk in with.
Why should I AI-review my codebase before hiring a dev shop?
Because the alternative is paying shop rates to find problems you could have found for free. A dev shop's first billable week on a takeover is almost always an audit — reading the codebase, mapping what's sound, flagging what's not. If you run the cheap version of that audit yourself first, you walk in with a list instead of a mystery. You'll know whether you're negotiating a rescue quote or a rewrite quote before the shop tells you, and you'll know if the number they give you matches what you found.
What should the pre-handover check actually cover?
Four things, in the order they tend to bite:
| Check | What it catches | How to run it yourself |
|---|---|---|
| Secrets in git history | API keys, database credentials, and tokens committed in plain text — a common default when an agent writes the first commit | git log -p | grep -i for key patterns, or a scanner like gitleaks or trufflehog against the full history, not just HEAD |
| Dependency bloat | Packages the agent pulled in to solve one problem, never removed, now shipping with the app | npm audit, npm outdated, or pnpm why <package> on anything you don't recognize adding |
| Auth coverage | Routes the agent built for a demo flow and never gated behind a login or role check | List every API route by hand, confirm which ones return data without an auth check |
| Test coverage | Whether anything touching money or user data has a test that would catch a regression | Run the project's coverage tool if one exists; if none exists, that's the answer |
None of these require reading the whole codebase. A senior engineer with repo access can run all four in an afternoon, and most AI code-review tools (Claude Code, Cursor's review mode, GitHub's Copilot review) will surface the first three automatically if you point them at the repo and ask directly — "scan git history for secrets" and "list routes with no auth check" are prompts, not research projects.
What if my codebase fails the check?
Then you've saved yourself a negotiation, not lost one. A shop that finds a hardcoded Stripe secret key in commit four of two hundred will quote you for a rotation-and-audit pass whether you knew about it or not — the difference is whether you knew before the call. We wrote about the rescue-vs-rewrite decision that usually follows a failed check in vibe-coded MVP: rescue the code or rewrite it: most failures are fixable in the $15,000-$60,000 rescue range, and only a genuinely unsound data model or auth layer pushes you into a full rewrite.
Can an AI code review replace a human audit?
No, and treating it as a substitute is the most common mistake we see. An AI review tool is fast at pattern-matching — it will find the committed key, the missing auth check, the package nobody uses anymore. It will not tell you whether your data model can survive the feature you're planning to ship in six months, and it will not catch a subtle logic error in how two services reconcile state, because that requires understanding the product, not just the code. Use the AI pass to walk into the shop's audit informed. Don't use it to skip the audit.
What does it cost to fix versus rebuild?
Almost always less than founders expect, and almost always less than a full rewrite. Rotating exposed secrets and adding auth checks to unguarded routes is a day or two of work, not a re-architecture. Dependency cleanup is an afternoon. The number that actually moves is test coverage on money- and data-touching code — building that out properly, if it doesn't exist, runs a few thousand dollars and belongs in the rescue budget, not treated as a free extra. None of this compares to the $50,000-$150,000+ a full rewrite costs, and running the check yourself first is how you find out you don't need one.
The one-line summary
Run the check before the call, not during it. A founder who shows up with "here's what I found" gets a scoped quote. A founder who shows up with "here's my repo, tell me what's wrong" gets a discovery invoice first.
Written 2026-09-15 by Naman Barkiya.