Built with AI? Get it audited before it ships.
Tapehack offers security audits purpose-built for AI vibe coding. Before your AI-built contracts, websites, back ends and APIs go live, we find the problems that could cost users money, and write the fixes as a spec your AI can follow.
The coding barrier is gone. The security barrier isn't.
More and more code is written by AI. AI gets the features working, yet it won't ask who can move the money, who can see other users' data, or what happens to users when something breaks. The more projects are built this way, the more an audit before launch matters.
Who writes the code has changed
Many teams don't read, or can't read, the code their AI wrote. Only an audit tells you what is really in it.
AI's blind spot is security
AI builds to the request. Permissions, adversaries and edge cases are not on its mind, and its code looks right, which makes problems harder to spot.
Code changes faster
AI rewrites code in minutes, and every change can bring new problems. The version that was audited must be the version that ships.
The cost of failure hasn't changed
On-chain transactions can't be reversed. Leaked user data can't be taken back.
Every part of the audit is designed around AI-written code
Where we look
Where AI-written code most often falls short: permissions, adversarial use, edge cases, external dependencies, secrets and configuration.
How we report
Written for people who don't read code. Conclusions, risks and decisions in checklists you can read in minutes.
How fixes are delivered
A remediation spec your AI coding tool can follow: where to change, how, what must not break, and how to verify, item by item.
How we re-audit
Each report locks the audited version with a file fingerprint. Changed the code? Audit it again, so what ships is what was audited.
We audit AI-written code, report to people who don't read code, and hand the fixes to your AI.
Two service lines for the two things AI builds
On-chain security audit
EVM-compatible chains such as BNB Chain and Ethereum
- Smart contract auditSolidity source code
- Web3 front-end auditWallet connection, approvals, sending transactions, recovering transaction results, release configuration
- On-chain permissions and stateWho can upgrade deployed contracts and move funds, multisig or a single wallet, and whether upgrades have a waiting period
Web security assessment and penetration testing
Websites, back ends, APIs, SaaS, payments, cloud deployments
- Accounts and sessionsSign-up and login, password reset, session handling, multi-factor
- Access controlHorizontal and vertical privilege escalation, tenant isolation
- Business logic and paymentsPricing, idempotency, callbacks, whether the books balance
- Input and injectionInjection, server-side request forgery, file upload and processing
- APIsAuthorization and data exposure in REST, GraphQL and WebSocket
- Data and cryptographyHow sensitive data is stored and sent, key and encryption usage
- Deployment and cloudRelease configuration, cloud permissions, dependency and build supply chain
- Browser sideFront-end trust boundaries, cross-site issues, content security policy, third-party scripts
Source and configuration reviews never touch live systems. Live penetration testing runs only against targets the client has authorized in writing, within an agreed scope. Both lines include re-audits, and with the client's consent we publish a public report in Chinese and English.
Common pitfalls in AI-written code
These are the problems most easily missed when code is written to a feature request. They are common knowledge across the industry.
On-chain
- Admin rights sit in an ordinary wallet; lose the key and you lose everything
- Funds sit in a contract someone else can upgrade, so your safety depends on them
- Users are asked for unlimited approvals
- Transfers don't check the amount actually received
- The compiler version isn't pinned
Web
- Switch accounts or change an ID and you see someone else's data
- Secrets and API tokens shipped in front-end code
- Password reset or verification codes can be bypassed
- Payment callbacks aren't verified, so amounts can be changed
- Cloud storage left public
- Third-party libraries with known vulnerabilities
Everywhere
- Code ships after changes with nobody looking at it again
- The live version doesn't match the audited version
- "The AI said it's secure" is not an audit
One audit, two files
After reading a report, most people hand the issues to their AI. So the part for people is short and clear, and the part for AI is complete and precise enough to execute.
Security Audit Report
For the team, the community and users: conclusions, high and medium findings, the full issue list, who can move funds, verification of the project's claims, notes for users, when the report stops applying, and the audit scope and limits.
PDF · Chinese / EnglishRemediation Spec for AI Vibe Coding
For your AI coding tool: for each issue, where to change, how, the rules the change must not break, and how to verify it, plus deployment checks and how to submit for a re-audit.
Markdown · Chinese / English- Report IDs look like TH-year-number, and both files share one ID. The first release is V1.0.0; later revisions count up.
- Each report names the exact code it covers and locks it with a SHA-256 fingerprint. Code changed afterwards is out of scope.
A finding makes the report only after three gates
Independent review
Several review tracks work separately and report on their own.
Adversarial challenge
Every significant finding is assigned a side whose job is to disprove it.
Reproduction
What survives is reproduced or confirmed in code, then signed off.
Every item in our reports comes with evidence and an acceptance check, with no guesswork and no padding.
An audit is not insurance
What we don't promise
- No audit finds every problem, and a report is not insurance.
- A report covers only the code version it names. Changed code, including code your AI regenerated, needs a new audit.
- We don't endorse any project, token or team, and reports are not investment advice.
Checks that need the project's cooperation
- On-chain operations that need real funds
- Tests that need a dedicated environment, such as load testing
- Internal practice, such as whether the deployed code is the code delivered
- Multi-role permission tests, which need test accounts for each role
Trust reports that state their limits.
Is this report really from Tapehack?
Verify a report
- Report IDs look like TH-year-number. Contact us to verify one.
- Compare the file's SHA-256 with the value on our Reports page. Change one character and it won't match.
- A report covers only the code version it names.
- We don't issue "passed" certificates. If someone claims one, check with us first.
Beware of impersonators
- Tapehack will never DM you first asking for payment.
- We will never ask for private keys or seed phrases.
- We will never ask you to connect a wallet, sign anything, or download software.
- An audit needs source code, contract addresses and docs. Never your keys.
Safeguarding projects built with AI vibe coding.
To make AI-written code hold up to scrutiny, through security audits designed for AI-generated code.
Request an audit
Please have ready
- A short project description and what you want audited
- Source code or repository; deployed contract addresses
- Project docs or requirements
- For penetration testing: the authorized scope and a testable environment