Skip to content

Compare

ShipReady vs LaunchGuard

A scanner that probes database functions and cross-account access from outside the app.

Last updated 2026-09-14

LaunchGuard price: Not stated on the public pages read. Results gating: Not stated on the public pages read.

Facts about LaunchGuard were read from their site on the dates shown. Tell us if something changed.

RowLaunchGuardShipReady
Score or evidence
LaunchGuard

The pages describe findings tied to specific probes rather than a single score.

Source: https://launchguard.dev/ (read 2026-09-14)

ShipReady

No score, no grade, no badge. Every finding shows the request that produced it and the date it was read.

What they show and what they keep
LaunchGuard

Public pages describe a scan against a supplied URL. Report handling is not stated in detail.

Source: https://launchguard.dev/ (read 2026-09-14)

ShipReady

The full free result is shown to anyone with the check id. Nothing is gated behind a paywall or an account.

What they do to your app
LaunchGuard

Explicitly probes database functions and IDOR-style cross-account requests from outside, so it can trigger writes and read attempts against your app.

Source: https://launchguard.dev/ (read 2026-09-14)

ShipReady

Deterministic outside requests only. Never signs in, never executes a function on your database, never reads another account's data.

What neither can see from outside

Neither an outside scanner nor a public research report can prove these from a URL. They need code, account, runtime or operational access.

  • Rollback and recovery. Whether you can put the previous version back, and how long that takes.
  • Error monitoring. Whether a failure in production reaches a human rather than sitting in a log nobody opens.
  • Sign in and account flows. Whether sign in, password or code reset, and session expiry behave under real use.
  • Rate limiting and abuse controls. Whether a script can hammer your forms, sign up loop, or paid endpoints without being slowed down.
  • Key rotation. Whether you can replace a leaked key quickly and know everywhere it is used.
  • Certificate expiry date. Whether the certificate is close to expiring. A normal request proves the certificate is valid right now, and the runtime this check uses cannot read the expiry date from that request.
  • One account reading another account's data. Whether a signed in account can reach another account's records by changing an id. ShipReady does not create accounts, sign in, or call your functions, so this cannot be answered from outside.
  • Payment handling. Whether payment events are verified, replay safe, and matched to the right customer record.
  • Customer data handling. Whether stored personal details are limited, deletable on request, and out of your logs.
  • AI feature controls. Whether prompts, spend, and model output are bounded so one visitor cannot run up the bill.
  • Database row rules. Whether the row rules behind the app actually stop one signed in account reading another's rows.
Fixes
LaunchGuard

Findings describe the probe and its response. Public pages do not list per-builder fix prompts.

Source: https://launchguard.dev/ (read 2026-09-14)

ShipReady

Every finding carries five fix prompts for Lovable, Bolt, Base44, v0 and generic coding assistants, hand written per finding.

Beyond security
CapabilityLaunchGuardShipReady
Legal page links
Email authentication
Domain expiry
Cookie flags
Platform trust evidence

Source: https://launchguard.dev/ (read 2026-09-14)

What happens next
LaunchGuard

Read the report, then decide whether to remediate on your own.

Source: https://launchguard.dev/ (read 2026-09-14)

ShipReady

You can stop at the free check, or buy the Release Gate at $49 for the package, the Launch Review at $199 for a person, or the Hardening Sprint at $1,750 for the fix work.

Competitor strengths

Actively probes database functions and cross-account paths from outside, which surfaces a class of failure a passive outside scan cannot.

Source: https://launchguard.dev/ (read 2026-09-14)

Choose LaunchGuard if

You want an automated probe of your database functions and cross-account paths from outside, and you accept the trade-off that automated probing sends requests to your app that you would rather a person controlled.

Why our free check does not probe functions or accounts

ShipReady's free check never executes a function on your database and never signs in as one of your users to read another's data. Automated probes can trigger writes, corrupt state, or count toward rate limits on production accounts, and the person on the other end has not agreed to that. In the Launch Review a person does this work under explicit scope, with your approval, against a real test account, and writes up what they saw, which is why probing that shape lives there instead of in the free check.

ShipReady statuses explained

Observed means an outside request produced direct evidence.

Declared means the app owner supplied the information.

Not verified means the item needs code, account, runtime or operational access.

Could not check means the attempt did not produce a reliable answer.

Sources read for this page

Check your app

Run all sixteen groups on your published address and see the evidence behind every result.

Running it confirms you own this app or are authorized to test it. ShipReady reads its public pages and JavaScript bundles.

ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.

Last updated September 20, 2026