Home › Roast Leaderboard
Vibe Code Roast Leaderboard
We ran Prompt Medic’s /roast on popular open-source starter templates that people build AI apps on. These are well-made projects from teams we respect. The point is to show what an automated review catches, and which quick wins are worth copying into your own fork. Roasted 2026-10-20 on the default branch, sampling up to 15 key files per repo.
Caveat: this is an automated AI review of a sample of files, not a security audit. Findings can be wrong or already fixed. Maintainers who spot a mistake can reach us on X @PromptMedicAI and we’ll correct it.
| # | Template | Score |
|---|---|---|
| 1 | t3-oss/create-t3-app | 8/10 |
| 2 | vercel/chatbot | 6/10 |
| 3 | vercel/nextjs-subscription-payments | 6/10 |
| 4 | stackblitz/bolt.new | 6/10 |
| 5 | shadcn-ui/taxonomy | 4/10 |
#1 t3-oss/create-t3-app: 8/10
T3 still slaps, but the auth spaghetti and stale next.config are giving me heartburn.
🔒 Security
Nothing major found.
🐛 Bugs
- next.config.js: i18n still present despite comment warning it breaks appDir (used in all app router templates)
- cli/src/cli/index.ts: auth select uses 'next-auth' value but installer map expects 'nextAuth' (and same for better-auth)
⚡ Quick wins
- cli/package.json: bump engines.node to match root (>=20) to avoid version skew
- cli/template/extras/src/server/better-auth/server.ts: import from './index' instead of '.' for clarity
- cli/src/index.ts: add explicit check that nextAuth + betterAuth were never both selected before install
Reviewed 15 files.
#2 vercel/chatbot: 6/10
Solid bones, but the AI SDK calls are cosplaying as v5 docs
🔒 Security
Nothing major found.
🐛 Bugs
- 'instructions' prop passed to streamText in artifacts/code/server.ts, artifacts/sheet/server.ts, artifacts/text/server.ts (not a valid option; use system)
- createDocumentHandler type mismatch: config fns return Promise<string> but wrapper declares Promise<void> (lib/artifacts/server.ts)
⚡ Quick wins
- Add try/catch + dataStream error handling in all three document handlers
- Remove duplicate dotenv config() calls across drizzle.config.ts and playwright.config.ts
- next.config.ts: cacheComponents isn't a real flag in Next 16
Reviewed 15 files.
#3 vercel/nextjs-subscription-payments: 6/10
Solid SaaS skeleton, but auth logic forgot to hang up the phone.
🔒 Security
Nothing major found.
🐛 Bugs
- utils/auth-helpers/server.ts: signInWithEmail, requestPasswordUpdate, signUp, updatePassword set redirectPath on validation fail but never return, so execution continues with bad data
⚡ Quick wins
- utils/auth-helpers/server.ts: add early returns after every redirectPath assignment
- utils/supabase/server.ts: assert env vars exist before createServerClient
- utils/stripe/server.ts: validate price.id and trial_period_days before Stripe calls
Reviewed 14 files.
#4 stackblitz/bolt.new: 6/10
Bolt.new zaps full-stack dreams but its homemade crypto shorts the circuit.
🔒 Security
- Custom AES-CBC in app/lib/crypto.ts uses raw string key with encodeBase64 and no key derivation or length checks
🐛 Bugs
- encrypt places IV after ciphertext then decrypt reads it correctly but getKey/importKey assumptions are fragile (app/lib/crypto.ts)
⚡ Quick wins
- Add key length validation and use crypto.subtle.generateKey or PBKDF2 in app/lib/crypto.ts
- Replace console.log with proper logger in app/routes/api.chat.ts and api.enhancer.ts
Reviewed 15 files.
#5 shadcn-ui/taxonomy: 4/10
Next.js 13 fossil: charming but held together with duct tape and 'as any'
🔒 Security
- PrismaAdapter(db as any) in lib/auth.ts bypasses types and hides potential adapter mismatches
🐛 Bugs
- GitHub sign-in in components/user-auth-form.tsx sets isGitHubLoading true but never resets it on redirect/failure
- lib/db.ts global cachedPrisma pattern risks stale connections or multiple instances under hot reload
⚡ Quick wins
- Bump ancient next@13.3.2-canary.13 and typescript@4.7.4 in package.json
- Drop unused importOrderParserPlugins from prettier.config.js
- Add error handling around signIn('github') in user-auth-form.tsx
Reviewed 15 files.
Roast your own repo
Add Prompt Medic to Discord and run /roast repo:https://github.com/you/your-app. You get 1 free roast a day. Then make a shareable roast card.