Term
Anon key
The public browser key. Safe to publish, useless without rules behind it.
1 findings
Learn
Plain words for the whole glossary
44 terms that turn up on a result or in the work around it. No jargon defined with more jargon. Each one links to the findings and incidents where it matters.
44 termsLast updated September 13, 2026
- Term
Batch prompt
One instruction that fixes several findings in a single pass.
1 findings - Term
Claim token
The unguessable string that lets you attach an anonymous result to your account later.
1 findings - Term
Content-Security-Policy
The header that tells the browser which code it is allowed to run.
1 findings - Term
Cookie flags
The three settings that decide how safely a cookie travels.
1 findings - Term
Cost cap
The ceiling that stops one visitor spending your month's budget in an hour.
1 findings - Term
Could not check
The request failed, so there is no result for that item.
1 findings - Term
Cross origin rules
The header that decides which other sites may read your responses.
1 findings - Term
Declared
Something you told us, recorded as your statement rather than our finding.
1 findings - Term
Detected
Something the check worked out about your app without being told.
1 findings - Term
DMARC
The record that tells receiving servers what to do when mail fails your checks.
1 findings - Term
Domain expiry
The date your domain registration runs out, published in the registry.
1 findings - Term
Entitlement
The record that says this account paid for this thing.
1 findings - Term
Evidence
The line of raw observation behind a finding.
1 findings - Term
Exposed path
An address that answers when it should not.
1 findings - Term
Fingerprint
What your app quietly tells the internet about how it was built.
1 findings - Term
Fix prompt
A ready instruction for the tool that built your app.
1 findings - Term
frame-ancestors
The rule that stops another site putting your app inside an invisible frame.
1 findings - Term
Hardening Sprint
The $1,750 engagement that takes the top items from needs fix to fixed and re-verified.
1 findings - Term
HSTS
The header that tells browsers to never speak to your site over plain HTTP again.
2 findings - Term
Idempotency
Doing the same thing twice has the same effect as doing it once.
1 findings - Term
Launch Review
The $199 review where a named person looks at what a URL cannot see.
1 findings - Term
Launch Risk Statement
A dated page saying what was observed, what was declared, and what nobody verified.
1 findings - Term
Mixed content
A secure page loading something over plain HTTP.
1 findings - Term
Not verified
Named items nobody checked, listed rather than quietly dropped.
1 findings - Term
Observed
Something a check actually read from your published app, with the evidence attached.
1 findings - Term
Open signup
Whether anyone can create an account, and whether the address has to be proved.
1 findings - Term
Prompt injection
Text your app feeds to a model that the model treats as instructions.
1 findings - Term
Publishable key
The newer name for a public client key. Same rule: public by design, not a permission.
1 findings - Term
Rate limit
The rule that slows down whoever is asking too often.
1 findings - Term
Release Assurance
The monthly option that keeps a current statement for teams shipping every week.
1 findings - Term
Release Gate
The $49 package that hands you the checklist and the guardrails to fix things yourself.
1 findings - Term
Rollback
Putting the previous version back, quickly, when the new one is wrong.
1 findings - Term
Row level security
The rule that decides which rows of a table an account may read or change.
1 findings - Term
Security definer
A database function that runs with its author's permissions rather than the caller's.
1 findings - Term
Service role key
The key that ignores every access rule. It belongs on a server and nowhere else.
1 findings - Term
Slopsquatting
Registering the package names AI tools invent, and waiting.
1 findings - Term
Source map
The file that turns your shipped bundle back into readable source.
1 findings - Term
SPF
The DNS record naming who is allowed to send email as your domain.
1 findings - Term
Staleness
How out of date an observation is, stated rather than hidden.
1 findings - Term
Storage bucket
The place uploaded files live, and the setting that decides who can read them.
1 findings - Term
Tenant isolation
One customer's data staying entirely out of another customer's account.
1 findings - Term
Trust Center
A published page that answers the security questions buyers ask.
1 findings - Term
Webhook signature
Proof that the message really came from the service that claims to have sent it.
1 findings
Check your app
Run all sixteen groups on your published address and see the evidence behind every result.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026