Vibe Coding Security Audit
Security audit for AI-built apps: exposed API keys, NEXT_PUBLIC secrets, Supabase service_role, open API routes, Stripe webhooks, CORS. Grade + fixes. $29.
View Vibe Coding Security Audit
Find out whether your RAG bot fails at retrieval, chunking or answering, and prove a change made it better.

Your retrieval-augmented chatbot answers from your documents, until it doesn't: the right page isn't retrieved, the answer invents a number, or it confidently answers a question your docs never cover. This kit measures all three on a set of test questions, so you can change the chunk size, embedding model, prompt or LLM and see whether things got better or worse.
The screenshot is real output from the kit’s own commands. Tested from a fresh download of this exact zip: ./run_tests.sh ran 8 tests OK on Python 3.13 and 3.10.

python3 -m ragcheck bm25 qa.jsonl --docs docs/ --sweep 100,200,400 # baseline + chunk sizes
python3 -m ragcheck run qa.jsonl --pipeline "python3 my_rag.py" --out run-a.json
python3 -m ragcheck eval qa.jsonl logged-results.jsonl --judge openai:<model> --out run-b.json
python3 -m ragcheck compare run-a.json run-b.json
python3 -m ragcheck eval qa.jsonl results.jsonl --min faithfulness=0.9 --min hit@5=0.8 --format md >> "$GITHUB_STEP_SUMMARY"./demo.sh evaluates a fictional coffee shop's help-center bot (8 docs, 11 questions): the chunk-size sweep, then a recorded LLM run where ragcheck catches a retrieval miss ("torn open" vs "damaged"), an invented "10 business days" refund time and an answer about a café that doesn't exist. ./run_tests.sh runs 8 test groups.
Dataset (qa.jsonl), one question per line:
{"id": "q05", "question": "How quickly do refunds reach my card?", "ground_truth": "Within 5-7 business days after approval.", "relevant": ["refunds.md"], "must_include": ["5-7 business days"]}
{"id": "q11", "question": "Do you have a café in Denver?", "answerable": false}Results (results.jsonl, or what your --pipeline prints for each question):
{"id": "q05", "answer": "Refunds arrive within 5-7 business days.", "contexts": [{"id": "refunds.md#2", "text": "Refunds go back to..."}]}contexts can also be plain strings; text, content and page_content keys are all read. The pipeline gets {"id": ..., "question": ...} on stdin and prints one JSON line. examples/simple_rag.py is a short example (BM25 + extractive answers).
Zip, 30 KB, v1.0, 26 files. You may use and modify this kit for your own work and for clients you serve, including paid client work. Not affiliated with or endorsed by any model or vector database vendor.
RAG evaluation kit: hit@k, recall, MRR, nDCG, faithfulness, context recall and answer F1 on your own questions. BM25 baseline, chunk sweep, CI gates. $29.
Security audit for AI-built apps: exposed API keys, NEXT_PUBLIC secrets, Supabase service_role, open API routes, Stripe webhooks, CORS. Grade + fixes. $29.
View Vibe Coding Security AuditSupabase RLS checker for migrations: tables without RLS, using (true) policies, user_metadata, slow auth.uid(), definer views. Fix SQL included. $19.
View Supabase RLS CheckerDockerfile linter with fixes: non-root user, pinned slim images, secrets in ENV/ARG, apt cache, COPY order, .dockerignore. SARIF + Claude Code skill. $19.
View Dockerfile Linter & Best Practices CheckerShort weekly digest of new x402 + MCP tools and free kits, including the MCP OAuth Checker. No spam, unsubscribe any time.