You described the app, the AI built it, and it works — you clicked through it yourself. Claude Code, Cursor, Bolt, Lovable, v0: whichever tool you used, the result is the same kind of artifact. A site that looks finished, built by an assistant that optimizes for "looks finished," reviewed by exactly nobody.

Here's the uncomfortable part: in the AI-built sites we test, the same defects show up again and again — API keys readable in the JavaScript bundle, links to pages that were never generated, forms that accept anything, security headers that simply aren't there. None of these are visible in a click-through. All of them are visible to your users, to Google, and to anyone who opens DevTools.

You don't need to become a QA engineer. You need a repeatable 20-minute workflow. This is that workflow, using Kuality.io's AI QA test for vibe-coded sites.

Why AI-built sites fail in the same five ways

1. Exposed secrets. Assistants take the shortest path to "it works," and the shortest path to calling an API is putting the key in client-side code. That key is now public. A JavaScript security audit reads your shipped bundles the way an attacker would and flags every credential and token it finds.

2. Hallucinated structure. LLMs confidently link to /about, /docs, or /blog pages that were never built, and leave anchor links pointing at sections that don't exist. A broken link crawl catches every 404, dead external link, and redirect chain.

3. Missing hardening. Generated starter code almost never sets a Content-Security-Policy, HSTS, or frame protection. Your security headers are the difference between "annoying to attack" and "trivial to attack."

4. Untested interaction. The signup form, the contact form, the checkout — the AI wired them, you admired them, nobody ever submitted them with hostile or even slightly unusual input.

5. Invisible quality debt. Accessibility failures (missing labels, broken focus, low contrast), Core Web Vitals regressions from bloated generated bundles, and absent SEO basics — sitemaps, titles, meta descriptions. Users feel these before you see them.

Step 1 — Run one full test against the live site

Create a free Kuality.io account, paste your site's URL, and run the full test. There is nothing to install and no test code to write — the scan runs against the deployed site, which is the only thing that matters anyway. Your local build passing means very little if the deploy env is missing a variable.

One run executes 37 checks: security scans, link crawling, form and flow testing, accessibility, performance, SEO, SSL, DNS, cookies. You get a single report, ordered by severity, in plain language.

Step 2 — Triage in this order

Fix findings in this order, and resist the urge to polish first:

1. Anything marked critical in security — exposed keys, vulnerable dependencies, authentication issues. These are "today" problems: rotate the key first, then fix the code that exposed it.

2. Broken functionality — dead links, failing forms, error pages. These cost you every user who hits them.

3. Hardening — security headers, cookie flags, SSL configuration. Ten minutes of configuration, permanent payoff.

4. Quality — accessibility, performance, SEO. These decide whether the site works well, after the first three decide whether it works at all.

Step 3 — The fix loop: feed findings back to your AI

This is where the workflow gets genuinely pleasant. You vibe-coded the site, so vibe-fix it: copy a finding out of the report and paste it into Claude Code or Cursor as a prompt, roughly like this —

"My QA scan found this issue: [paste the finding, including the affected URL and description]. Fix it, and check the rest of the codebase for the same pattern."

The reports are written to be specific enough that an AI assistant can act on them: exact URLs, exact headers, exact elements. Fix, redeploy, hit re-test, and watch the count drop. Most vibe-coded sites go from first scan to clean critical findings in an afternoon — the same afternoon the site was built in.

Step 4 — Test behind the login

The public pages are half the story. The dashboard, settings, and paid features your AI generated are where state actually changes — and where untested code does real damage. Add a set of test credentials in Kuality.io and the authenticated area gets discovered and tested too: the scanner logs in, maps what's behind the door, and runs the same checks there.

Use a dedicated test account, never a real user's. If you set your project up with seed data, this takes two minutes.

Step 5 — Make it continuous, because you will keep vibing

The site you shipped today is not the site you'll have in a month — that's the whole point of building this way. Every "add a quick feature" prompt is a fresh chance to reintroduce all five failure modes.

Two habits keep you honest: schedule a recurring test (weekly is fine for a side project, daily for anything with customers) so regressions surface the day they ship, and when the project graduates to a real pipeline, add a CI/CD quality gate via the CI API so a deploy that fails QA never goes live in the first place.

Frequently asked questions

Do I need to know how to code to use this? — No. If you can paste a URL and paste findings back into your AI tool, you can run the entire loop. The report explains each issue in plain language, and your assistant handles the code.

My AI says the code is secure. Is it? — Your AI reviewed the code it wrote, from the inside. A scan tests the deployed site from the outside, the way an attacker or a user meets it. Those are different questions with different answers — the gap between them is exactly where vibe-coded sites get hurt.

What does it cost? — First tests run on the free plan, no credit card. Paid plans add volume, scheduling, and team features when the project turns serious.

Does this replace writing tests? — For a solo vibe-coded project, it covers the risks that matter most with zero maintenance. When the codebase grows up, add unit tests too — external QA and internal tests catch different bugs.

Ship it — tested

Vibe coding collapsed the cost of building software. It didn't collapse the cost of shipping broken software — that one's still paid in full, by you, in public. Twenty minutes of QA closes the gap.

Run a free AI QA test on your vibe-coded site →