Case · AO-2026AxisSheet 01

AUDITOR

We break the code with tests and show what failed, where, and why — not “looks fine”, but a fact.

Margin note

Your AI wrote the code. We check whether it actually works.

AUDITOR finds risky spots, runs checks in an isolated environment, and shows which problems were confirmed. Not an AI opinion — evidence.

Check code See a sample check

Paste a snippet, upload a ZIP, or connect Git — then run your first check.

DEMO · NOT LIVESample · not your audit

E-01checkout/charge.ts · double chargefail
E-02auth/session.ts · token bypassfail
E-03api/orders.ts · write raceretest

The point

Sheet 02 / 02

AI can write code. Trusting it at face value is a bad idea.

We try to break the code with tests and show the result: what failed, where, and why.

Verdict stamp

Not “looks fine” — “here is what broke”.

What we do

We do not just read code. We generate tests, apply load, and try to break it.

Check loop: signal → test → run → reproduce → evidence. A model opinion alone is not proof.

01
Find the signal
Mark places where logic, access, or a race can fail. · STATIC ANALYSIS
02
Generate a test
Build a scenario: parallel requests, edge payments, repeated access. · TEST GEN
03
Run and press
Execute the scenario, including load and timeouts — not “eyeball review”. · RUN / LOAD
04
Reproduce
If it fails — repeat. We need a stable failure, not a one-off glitch. · REPRODUCE
05
Capture evidence
Show what broke, under which input, and what confirms it. · EVIDENCE

Why not ask AI

You can just ask AI: “Is everything fine?”

AI opinion

You can. But it is still the opinion of the same system that wrote the code. Without a real check it is self-grading.

Opinion · no proof

Auditor check

We generate a test, run it, try to reproduce. If it fails — you see where and why. Not a confident model tone — a repeatable result.

Fact · repeatable

Example

Online store and charging money

AI wrote a balance charge function. At first glance it works: item bought, money left. But with two fast requests and several clients the balance can be charged twice. For a buyer that is a bug. For the business — lost money.

Auditor did not “warn by eye”. It generated a scenario, ran a race, and confirmed the problem. Below is a demo sheet (not a live audit).

Check sheet

Check sheet · demo

Human outcome on top. Technical log below, secondary.

DEMO · NOT LIVE

ID	Where	Signal	Status	Sev.
F-042	payment → charge	money can be charged twice	CONFIRMED	high
F-043	database query	data is joined unsafely	CONFIRMED	high
F-044	user session	suspiciously long access window	SUSPECT	med

What the tests showed

DEMO · NOT LIVE

Double purchaseFAIL912 msbalance went below zero
Race · 8 clientsFAIL1.4 stwo charges for one order
Id swapFAIL184 msrequest accepted foreign data
Normal purchaseOK61 msone happy path is not enough

Load and races

Auditor presses the code — it does not stop at a static look.

Below are demo cases: how a check looks when concurrency, retries, payment edges, and post-AI regressions matter. Method illustrations, not live numbers.

Method · not “AI thinks it is bad”

01
Generate a test
The scenario targets a risk: race, IDOR, payment, timeout.
02
Run it
The test executes — a single pass and a pressured retry.
03
Reproduce
The failure must repeat. Otherwise it stays a suspicion.
04
Evidence
The report shows input, step, result — not a confident model tone.

Probe demo cases

DEMO · NOT LIVE

P-01
Auth race
Two concurrent logins / session refreshes. A single request looks “ok”; under concurrency it breaks.
Probe
N parallel POST /session · same refresh
Evidence
One session got another user’s context; a re-run showed the same failure.
REPRODUCED
P-02
IDOR under repeated requests
User A enumerates other people’s order ids. Once may be missed; a series exposes the hole.
Probe
Repeated GET /orders/{id} with foreign ids
Evidence
HTTP 200 with another owner’s data; path and response body captured.
CONFIRMED
P-03
Payment edge
Double click, zero amount, repeated webhook. A normal purchase works — edge cases do not.
Probe
Double charge · amount=0 · repeated callback
Evidence
Balance dropped twice / zero payment accepted; scenario repeated.
CONFIRMED
P-04
Load and timeout
Under moderate load the endpoint stalls or returns 5xx. Manual checks feel “fast”.
Probe
Request series · wait limit · timeout cut-off
Evidence
Some requests missed the limit; step log and status code in evidence.
FAILED UNDER LOAD
P-05
Regression after an AI fix
The model “fixed” a bug. The old test is green; a neighbor case is red. Without a re-run you will not see it.
Probe
Same suite before/after the patch · neighbor case
Evidence
The new patch closed one issue and opened another; both runs are in the report.
REGRESSION

Method

How we check code written by AI

This is not a generic textbook checklist. The audit uses a working method for generated code: what to look at first, which tests to build, and when a problem counts as confirmed.

Built by a practitioner · fullstack · ~20 years in development

01
Behavior first, code beauty second
We look at what the system does on real inputs: payment, access, races, retries. Clean style without behavior checks is not enough for AI code.
02
A test for the risk, not “just in case”
The scenario is built around a concrete threat or failure. The goal is to reproduce a break, not inflate formal coverage.
03
Repeat until evidence
One odd run is not a conclusion. We need a repeatable result: input, step, response. Otherwise it stays a suspicion.
04
After an AI fix — through the same loop
After a model patch we re-run the related suite. Otherwise it is easy to close one issue and open a neighbor.

In short: the audit follows an engineering loop “find → test → reproduce → record”, not the model’s confidence in its own code.

Trust

Where the check runs and what happens to your code

Ready service on stack-lab.space: we already check code on our side. Optionally code can stay with you (Private Runner). Same checking engine. No certificates or loud promises — only what the product actually has.

Live
On our servers
We already check on stack-lab.space — in a closed sandbox without internet access. Default mode. In this mode we see your code — otherwise the check cannot run. External AI may receive context only if workspace policy allows it.
On request
On your server
Optional: Private Runner. Code stays with you; your machine runs a checking agent, and we receive the result — without sources (unless you allow a copy). Available on request for company plans.
Soon
Fully yours / no cloud AI
Install fully on your side and a mode without outbound calls to external cloud AI services. Still in preparation — not sold as ready.

Your code is not used by default to train third-party models.
External AI is governed by workspace policy: if policy forbids it, the request does not leave.
Operational AI logs do not keep full prompts or sources — only volume and cost accounting.
The sandbox is offline by default: untrusted code and tests cannot reach the internet or host Docker.
Where the check runs is decided by the server (workspace mode) — browser-only settings change nothing by themselves.
Audit artifacts are kept per plan retention rules; secrets and API keys are hashed.

We do not claim “we never see your code” — in cloud mode we do, otherwise we cannot check it. Need code to stay in your network? Optional “on your server” mode — via Enterprise contact or workspace settings on a suitable plan.

What we check

What can go wrong?

Security
Can someone steal data or do something they must not?
SECURITY
Logic and payments
Does the code count correctly on edges: zero, double click, repeated webhook?
LOGIC
Access
Can a user see other people’s orders across a request series (IDOR)?
AUTHORIZATION
Races and load
Does the code hold when requests run in parallel or hit a timeout?
CONCURRENCY / LOAD
Errors
Does the system fail on empty data, outages, odd inputs?
ERRORS
Regression after AI
Did a model “fix” break a neighbor scenario that used to work?
REGRESSION

For business

You do not have to read the code.

You only need the outcome: can you trust the AI result before customers see it.

See confirmed problems in plain language
Understand risk before release, not after complaints
Show a developer a concrete failure, not “I feel like…”
No need to become an engineer to decide

For developers and freelancers

For people who write code with AI every day.

A fast second check before you hand work to a client or merge to main.

Paste a snippet — get a checkable result
Less manual “what if it breaks”
Easy to attach for a client: here is what we found and confirmed
Technical detail stays, but the clear outcome comes first

Before and after

How the path to release changes

Without Auditor

01
AI wrote the code
02
Quick eyeball review
03
Shipped to users
04
Catch problems in production

With Auditor

01
AI wrote the code
02
The check finds and reproduces problems
03
You see what is confirmed
04
You fix and re-check — then release

Your AI wrote the code.

We try to break it.

Not an AI opinion. Evidence. Finding a problem before users is almost always cheaper than fixing it after.

AI Challenge

Compare different AI answers on one task

One brief, one set of checks. See whose code survives the test and whose does not. This section is being prepared.

AI Challenge — soon

What you get

A short check summary

DEMO LABELS

Found: Signals; Where the code looks risky
Confirmed: Real failures; What we managed to reproduce
Fixed: Patch; When the problem is already proven
Outcome: Trust / do not trust; A decision from facts, not model confidence

Pricing

Check code without wasting budget.

Start free. When you have more projects — pick a plan for your volume.

Free
Free
Project size
≤ 3,000
Limit / mo
3 checks / mo
Start
Pro
For developers
1,990 RUB/ mo
Project size
≤ 15,000
Limit / mo
100 Units
Choose
Team
5,990 RUB/ mo
Project size
≤ 30,000
Limit / mo
500 Units
Choose
Business
14,990 RUB/ mo
Project size
≤ 200,000
Limit / mo
2,000 Units
Choose
Enterprise
custom
Project size
200,000+
Limit / mo
custom
Talk to us

Check code without wasting budget.
Plan	Price	Project size	Limit / mo	Action
Free	Free	≤ 3,000	3 checks / mo	Start
ProFor developers	1,990 RUB/ mo	≤ 15,000	100 Units	Choose
Team	5,990 RUB/ mo	≤ 30,000	500 Units	Choose
Business	14,990 RUB/ mo	≤ 200,000	2,000 Units	Choose
Enterprise	custom	200,000+	custom	Talk to us

An Audit Unit is spent when an audit actually starts. Free — 3 units/month with reduced AI; Pro — more units and full AI.

The line limit is the max size of one project. Units are how many checks you can run per month. Different limits.

Pricing in short

What does the plan limit — lines or Units?: Both. Lines cap project size. Units cap how many audits you can start in a billing period.
Is there AI on Free?: Yes, within 3 checks/units per month — reduced mode. When units run out, we show the quota. Pro gives more units and full AI.
Can I change plans later?: Yes. Start on Free, then pick a plan for your volume. Enterprise — via contact form: limits and Private Runner. Card payments come later (Phase 25).

Check the code before your users do.

Check code

FAQ

The essentials

Do I need to understand programming?: No. First you see a plain outcome: what was confirmed and how serious it is. Technical detail can be opened if the team needs it.
How is this better than asking AI “all good?”: AI can misjudge its own code. Auditor tries to reproduce the problem and show a real failure, not a confident answer tone.
Can I check code right now?: Yes: sign up, create a project, paste code or connect Git, and start a check. The landing “Example” block is a demo illustration, not your audit.
What about GitHub and repositories?: Git connect is already in the product (GitHub and other providers by plan). You can pick a repository and branch when creating a project or in the Git panel.
Where does my code go?: In normal (cloud) mode we already check code on stack-lab.space — and do not send it to train third-party models. If optional “on your server” mode is on, sources are not uploaded to us by default. More in the Trust block and the privacy policy.
Is this for business or developers?: Both. Owners need clear risk before release. Developers and freelancers need a fast check before delivery.
Do I need to upload the whole repository?: Not necessarily. Paste a snippet, upload a ZIP, or connect Git. Volume affects Audit Units and plan limits.
Is external AI used?: Depends on the AI Data Policy and the provider chosen in the workspace. Policy is visible when starting a check and in settings.
Can a found problem be fixed?: When Auto Fix is available on the plan, a patch goes through an isolated check and re-test. Fix APIs are still being prepared — we do not show fake patches.

Loading…