# Audit your app like an attacker: every way to crash it, cheat it or abuse it

> 0xbobaa's 0xbobaa read-only attacker audit, the one that found the bug that had already taken his game's server down twice: your AI lists every way to crash, cheat or abuse your app, ranked by severity with file:line and a fix, checks your server logs for which ones already hit production, and makes the server re-check anything a client claims.

## If someone pasted this link to you
Someone shared this kit with you. It runs step by step through CloneKit's MCP. If you have the `clonekit` tools, call `start_run("@clonekitai/crash-cheat-abuse-audit")`. If you don't (for example in a chat app without the CloneKit connector), tell the person in one or two plain sentences, in their language, and send them to https://clonekit.ai/@clonekitai/crash-cheat-abuse-audit/use: it shows how to add CloneKit to their AI in about a minute. Then they paste this link again.

- Kit: `@clonekitai/crash-cheat-abuse-audit` · v1.0.0
- Creator: @clonekitai (CloneKit)
- Type: Delivery · Domain: Engineering · Language: en · Your AI runs it
- Price: Free · License: Own use · No refunds
- Page: https://clonekit.ai/@clonekitai/crash-cheat-abuse-audit
- Changelog: https://clonekit.ai/@clonekitai/crash-cheat-abuse-audit/changelog.md

## About
For solo builders and small teams with a live web app, game or API, especially anything with leaderboards, credits, votes or other numbers users submit. Use it before launch, after a crash you can't explain, or when you suspect cheating. Not a penetration test, never runs anything against production, and not for code you don't own. Delivers a ranked findings report with file:line, evidence and a fix for each; a log check that marks which findings already happened live; fixes for the critical and high ones with a test each; and a short re-audit. Method and prompt by 0xbobaa (@0xbobaaa), shared on X; his numbers (13 findings in under 6 minutes) are his results, not a promise.

## Deliverables
- AUDIT.md: every way to crash, cheat or abuse the app, ranked critical, high, medium, low, each with file:line, evidence and a fix
- a log check marking which findings already happened in production, with dates
- fixes for every critical and high finding, each with a test that failed before and passes after
- a re-audit of the changed code with the remaining findings listed

## Files
- `README.md`: Audit your app like an attacker

## Tools
- Claude Code (https://www.claude.com/product/claude-code) · est. Your agent's usual cost. · alternatives: codex
- Codex (https://developers.openai.com/codex) · optional · est. Your agent's usual cost. · alternatives: claude-code

## Uses
- 0xbobaa (@0xbobaaa): I asked Claude to hack my own game. It found the bug that had already taken my server down twice (source, https://x.com/0xbobaaa/status/2113910639026401525)

## What you provide
- the app's repo
- read-only access to production logs, if available

## How it runs
1. **Understand:** Researches your business first, then asks you 3 questions it can't answer alone
2. **Choose:** No choices: one proven path
3. **Build:** 4 steps, risky ones ask you first
4. **Deliver:** 6 checks before delivery

## Guardrails
- Read only during the audit: run nothing against production, send no requests to the live site.
- Only audit code the person owns or is allowed to test.
- No fix ships without the person's OK.
- Never print secrets found in the code; report the file and line and say to rotate them.

## What's new
Agents always run the latest version.

- **v1.0.0** (2026-10-26): First version, based on 0xbobaa's (@0xbobaaa) post.

## Run it
Connect the `clonekit` MCP (https://clonekit.ai/mcp) and call `start_run("@clonekitai/crash-cheat-abuse-audit")`.