Skip to content

The Vibe Coding Audit: security for apps built with AI, from Getech

A Getech service for schools and trusts

The Vibe Coding Audit: secure before you ship.

You built it with AI. Before it holds pupil data or goes out to your whole school, make sure it is secure, compliant and ready for production. It starts with a free discovery call and a free code audit.

Free code audit
With every discovery call: your app's code reviewed, and a clear summary of what we find.
Security audit
An additional, in-depth audit of the running app, with a full report and a fix for every finding.
Deployment support
A deployment roadmap, and our help through every step from the first fix to go-live.
The challenge

It works. Is it safe?

Vibe coding has put real software in the hands of teachers and school staff. Describe what you need, and AI builds it in an afternoon: a reading tracker, a booking system, a revision tool for a whole year group.

But AI writes code that runs, not code that has been checked. It doesn't decide who should see what, where pupil data should live, or what happens when someone tries to break it. An app that looks finished can still be hiding the things that matter most.

  • Keys and secrets left in the pagePasswords and API keys that anyone can read, and anyone can use.
  • Missing access checksOne user able to see, change or delete another's data, or a pupil reaching staff-only pages.
  • Personal data in the wrong placePupil information stored outside the UK, or sent to services nobody agreed to.
  • Nothing standing in the way of misuseNo checks on what is typed in, and no limits on how often it can be asked.
The offer

Free to start. Support to the finish.

Every engagement begins with a free discovery call and a free code audit, so you know where your app stands before you commit to anything. If you’d like more, our security audit and deployment roadmap support take you all the way to launch.

Free

Discovery call and code audit

Included with every discovery call, with no obligation.

  • A conversation about your app, who uses it and the data it holds
  • A review of your app's code by our team
  • A clear summary of what we found and what it means
  • Honest advice on what to do next
Additional service

Security audit and deployment roadmap support

When you'd like us to take you the rest of the way, we hold your hand through every step.

  • A full security and compliance audit of the running app
  • A full report, ranked by severity, with a fix for every finding
  • A deployment roadmap, from the first fix to go-live
  • Hands-on support through fixes, re-testing, deployment and a pilot
How it works

Four steps from idea to production.

The first two are free. The second two are there whenever you want us beside you for the rest of the journey.

Step 1: Discovery call · Free

It starts with a conversation.

We get to know your app before we look at a line of it: what it does, who will use it, what data it holds, how it was built and where it runs.

Just as importantly, we learn what you need: a launch date to meet, a governors' meeting to report to, or a data protection officer who needs answers. The call is free, with no obligation.

  • What it does
  • Who uses it
  • What data it holds
  • Where it runs
Step 2: Free code audit

Your code, reviewed for free.

With every discovery call, our team reviews your app's code: how it handles sign-in and access, where it keeps its secrets, what it does with what people type in, and where its data goes.

You get a clear summary of what we found and what it means, so you know where you stand before you decide anything else.

  • Secrets and keys
  • Access checks
  • Input handling
  • Data handling
  • Next steps
Step 3: Security audit · Additional service

Tested the way an attacker would try it.

When your app needs more than a code review, our security audit goes further. We test the running app from the outside and the inside: as a stranger with no account, and as a signed-in user trying to reach further than they should.

Then we look past the code, at the hosting, the configuration, where the data really goes and how the app copes when it is pushed hard. All testing is non-destructive and agreed with you in advance.

  • An executive summaryWhere your app stands, in a page your senior leaders and governors can read.
  • Findings ranked by severityFrom critical to low, each with the evidence behind it, so you know what to fix first.
  • A fix for every findingClear, practical remediation, not just a list of problems.
  • A compliance assessmentHow the app measures up against UK GDPR and the DfE's standards, ready for your DPO.
Step 4: Deployment roadmap · Additional service

We hold your hand through every step.

Alongside the security audit, we build your deployment roadmap: every step from the first fix to go-live, agreed with you.

Then we walk it with you. We help put the fixes in place and re-test to prove they work, set the app up properly for production, run a pilot with a small group of staff or pupils, and act on what it shows before it reaches your whole school.

  • Deployment roadmap
  • Fixes
  • Re-testing
  • Production setup
  • Pilot
  • Go-live
From vibe-coded to production-ready.

Discover, review, test, plan, launch.

What the security audit checks

Everything between working and ready.

Your free code audit looks at the code itself. The security audit goes further, across every one of these areas, measured against UK GDPR, the DfE’s digital and technology standards for schools and its expectations for generative AI products.

Accounts and access
How people sign in, what each role can do, and whether one user can ever reach another's data.
Data protection and UK GDPR
What personal data it holds and why, how long it keeps it, and whether it can truly be deleted.
Where the data lives
Where it is stored and processed, and every outside service, AI models included, that it shares data with.
Input, injection and AI prompts
What happens when someone types something unexpected, from code injection to prompts that try to misuse the AI.
Secrets and dependencies
Keys and passwords kept out of reach, and the libraries it relies on checked for known vulnerabilities.
Hosting, load and recovery
Security headers, rate limits, how it copes under pressure, and backups proven by an actual restore.
Our method

Proven on our own platform first.

We hold our own work to the same standard. EduShare.uk, the platform this page is part of, has been through exactly this security audit: its code, its access rules, its data residency, its compliance and its behaviour under load.

Your app gets the same methods, scaled to its size and risk. Every finding is backed by evidence, every test is non-destructive, and the limits of what was tested are stated plainly, so you know exactly how far to rely on it.

Source code review
Sign-in, access rules, input handling, data deletion and how content is rendered, read line by line.
Testing from outside
Headers, access boundaries, rate limits, input validation and anything the app gives away to a stranger.
Testing as a signed-in user
Real sessions trying to reach other users' data, gain extra privileges or slip in fields they shouldn't set.
Testing in a real browser
Hostile content run in an actual browser, to prove protections hold where your users really are.
Load testing
Bounded, self-stopping runs that measure how the app copes under pressure and how fast it recovers.
Infrastructure review
Hosting, database, backups, secrets and DNS read first-hand, rather than taken from documentation.
Who it’s for

For everyone with a stake in it.

For a single app or several, for a school or across a trust. If it was built with AI and it is heading for real users, it is worth checking first, and the first check is free.

Staff who've built an app
Teachers and support staff with an app made in Gemini, AI Studio or any other AI tool, ready for more people to use.
IT and network managers
Who need to know an app is safe before it goes anywhere near the school's systems, accounts or data.
Leaders, DPOs and governors
Who are accountable for pupil data and need clear, independent assurance before saying yes.
Start with a conversation

Book your free discovery call.

Tell us about the app you've built, who it's for and when you'd like it live. Your discovery call is free, it comes with a free code audit, and there's no obligation to go further.

This form uses Google reCAPTCHA to block automated submissions. You have not allowed anti-spam cookies, so it has not been loaded and the form cannot be sent.

Book a free discovery call