https://shipreadyai.dev/learn/findings

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Findings explained

Every page under https://shipreadyai.dev/learn/findings, 68 in total.

- [Every finding, explained](https://shipreadyai.dev/learn/findings.md): One page for each of the 67 findings the free check can report.
- [Plain http traffic is sent on to https](https://shipreadyai.dev/learn/findings/o1-https-redirect-ok.md): Visitors who type the address without https land on the encrypted version instead of the plain one.
- [Plain http traffic is not sent on to https](https://shipreadyai.dev/learn/findings/o1-https-redirect-missing.md): Someone who reaches the plain http address stays on an unencrypted connection, so anything typed on that page travels in the clear.
- [The https address did not answer cleanly](https://shipreadyai.dev/learn/findings/o1-tls-failed.md): Browsers show a warning page or refuse the connection, so most visitors never reach the app at all.
- [The page loads some files over plain http](https://shipreadyai.dev/learn/findings/o1-mixed-content.md): Browsers block or downgrade these files, so parts of the page can break, and the padlock treatment is lost.
- [Every file on the page loads over https](https://shipreadyai.dev/learn/findings/o1-mixed-content-ok.md): Nothing on the page is pulled over a plain connection.
- [Strict-Transport-Security is set](https://shipreadyai.dev/learn/findings/o2-hsts-ok.md): Browsers remember to use https for this domain on later visits.
- [Strict-Transport-Security is not set](https://shipreadyai.dev/learn/findings/o2-hsts-missing.md): A browser that has been to the site before can still be pushed to the plain http version on a hostile network.
- [Content-Security-Policy is set](https://shipreadyai.dev/learn/findings/o2-csp-ok.md): The page tells the browser which sources of scripts and styles it will accept.
- [Content-Security-Policy is not set](https://shipreadyai.dev/learn/findings/o2-csp-missing.md): If any injected markup reaches a page, the browser has no rule telling it which scripts it is allowed to run.
- [The content policy allows inline scripts](https://shipreadyai.dev/learn/findings/o2-csp-unsafe-inline.md): The script-src rule includes unsafe-inline, which removes most of the protection the policy would otherwise give.
- [X-Content-Type-Options is set](https://shipreadyai.dev/learn/findings/o2-x-content-type-options-ok.md): Browsers will not guess a file type that differs from the one you declared.
- [X-Content-Type-Options is not set](https://shipreadyai.dev/learn/findings/o2-x-content-type-options-missing.md): A browser may treat an uploaded or user supplied file as a script because it guesses the type.
- [Framing is restricted](https://shipreadyai.dev/learn/findings/o2-frame-protection-ok.md): Other sites cannot silently place your pages inside their own.
- [Framing is not restricted](https://shipreadyai.dev/learn/findings/o2-frame-protection-missing.md): Another site can load your pages inside an invisible frame and trick a signed in visitor into clicking things they cannot see.
- [Referrer-Policy is set](https://shipreadyai.dev/learn/findings/o2-referrer-policy-ok.md): Outbound links do not carry the full address of the page the visitor came from.
- [Referrer-Policy is not set](https://shipreadyai.dev/learn/findings/o2-referrer-policy-missing.md): Full page addresses, including anything you put in a path or query string, are sent to third party sites your pages link to or load from.
- [Permissions-Policy is set](https://shipreadyai.dev/learn/findings/o2-permissions-policy-ok.md): Camera, microphone, and location access are limited to what you named.
- [Permissions-Policy is not set](https://shipreadyai.dev/learn/findings/o2-permissions-policy-missing.md): Embedded third party frames can ask for camera, microphone, or location on your domain's behalf.
- [Source maps are published next to the app code](https://shipreadyai.dev/learn/findings/o3-source-maps.md): Anyone can rebuild your original files, including comments, file names, and any logic you assumed was hidden.
- [No published source maps were reachable](https://shipreadyai.dev/learn/findings/o3-source-maps-ok.md): The bundles checked did not resolve to a readable source map.
- [A server side key appears in code the browser downloads](https://shipreadyai.dev/learn/findings/o4-secret-in-bundle.md): Anyone who opens the page can read this key and use it directly against the service it belongs to, with your account paying for it.
- [No server side keys matched in the downloaded code](https://shipreadyai.dev/learn/findings/o4-secret-none.md): The known server key patterns did not appear in the files checked. Publishable and browser keys are expected there and are ignored.
- [What the outside of the app reveals](https://shipreadyai.dev/learn/findings/o5-fingerprint.md): Anyone can see this from a browser. It is listed so you know what is on show.
- [A response header names a software version](https://shipreadyai.dev/learn/findings/o5-version-disclosure.md): Naming the exact version tells anyone scanning the internet which known issues to try first against your host.
- [A file that should not be public answers on the live site](https://shipreadyai.dev/learn/findings/o6-exposed-path.md): This file usually carries configuration, keys, or repository history, and it is readable by anyone who asks for it.
- [The common private files did not answer](https://shipreadyai.dev/learn/findings/o6-exposed-path-ok.md): Requests for configuration and repository files came back empty or missing.
- [Public information files](https://shipreadyai.dev/learn/findings/o6-public-files.md): These files tell crawlers and researchers how to treat the site.
- [The hosting platform publishes its own check results](https://shipreadyai.dev/learn/findings/o7-trust-evidence.md): The platform reports the following checks for this app: {checks}.
- [Some database tables answer without anyone signing in](https://shipreadyai.dev/learn/findings/o8-tables-exposed.md): A request made with the browser key alone returned rows, which means the row rules on those tables let anonymous readers in.
- [The table list is not readable without signing in](https://shipreadyai.dev/learn/findings/o8-schema-not-readable.md): An anonymous request could not list the tables behind the app.
- [A cookie is missing a protective flag](https://shipreadyai.dev/learn/findings/o9-cookie-flags.md): A cookie without Secure can travel over a plain connection, and one without HttpOnly can be read by any script on the page.
- [Cookies on the first response look fine](https://shipreadyai.dev/learn/findings/o9-cookies-ok.md): No cookie was set without its protective flags on this response.
- [No cookies were set on the first response](https://shipreadyai.dev/learn/findings/o9-no-cookies.md): The landing response set no cookies, so there were no flags to check.
- [An SPF record is published](https://shipreadyai.dev/learn/findings/o10-spf-ok.md): Mail servers can see which services are allowed to send using your domain.
- [No SPF record is published](https://shipreadyai.dev/learn/findings/o10-spf-missing.md): Anyone can send mail that claims to come from your domain, and your own mail is more likely to land in spam.
- [A DMARC record is published](https://shipreadyai.dev/learn/findings/o10-dmarc-ok.md): You have told receiving servers what to do with mail that fails the checks.
- [No DMARC record is published](https://shipreadyai.dev/learn/findings/o10-dmarc-missing.md): Receiving servers have no instruction for mail that fails the checks, so forged mail from your domain is more likely to be delivered.
- [Mail records were not checked for this address](https://shipreadyai.dev/learn/findings/o10-shared-domain.md): The app is on a shared hosting domain ({domain}), so its mail records belong to the platform and not to you.
- [A privacy page is linked](https://shipreadyai.dev/learn/findings/o11-privacy-ok.md): Visitors can find how their information is handled.
- [No privacy page is linked](https://shipreadyai.dev/learn/findings/o11-privacy-missing.md): Payment providers, app stores, and several privacy laws expect a reachable privacy page before you take anyone's details.
- [A terms page is linked](https://shipreadyai.dev/learn/findings/o11-terms-ok.md): Visitors can find the rules of using the product.
- [No terms page is linked](https://shipreadyai.dev/learn/findings/o11-terms-missing.md): Without stated terms you have no written basis for suspending misuse or limiting your liability.
- [A refund or returns page is linked](https://shipreadyai.dev/learn/findings/o11-refunds-ok.md): Buyers can see the refund position before they pay.
- [No refund or returns page is linked](https://shipreadyai.dev/learn/findings/o11-refunds-missing.md): Card processors expect a stated refund position, and disputes are harder to answer without one.
- [Functions callable by name from the public schema](https://shipreadyai.dev/learn/findings/o8-rpc-functions.md): The public schema names {total} functions callable by name: {functions}. Whether each checks authorization needs a code review. ShipReady lists the names and never calls them, which is why backend rules stay on the not verified list.
- [The storage bucket list answers without a sign in](https://shipreadyai.dev/learn/findings/o12-buckets-listable.md): A request with the browser key returned the names of {total} storage buckets: {buckets}. Names alone give a reader the shape of what you store.
- [Some storage buckets are readable by anyone with the address](https://shipreadyai.dev/learn/findings/o12-bucket-public.md): These buckets are marked public, so any file inside one can be read by anyone who knows or guesses its address: {buckets}.
- [Storage buckets list their objects without a sign in](https://shipreadyai.dev/learn/findings/o12-objects-listable.md): An object list request carrying only the browser key came back from these buckets: {buckets}. The counts show how much is behind each name. ShipReady records names and counts and never keeps an object name or a file.
- [Files in a listing bucket open without a session](https://shipreadyai.dev/learn/findings/o12-objects-readable.md): One object address from each of these buckets answered a plain request with no session: {buckets}. Anything stored there can be read by anyone who can list it.
- [Storage did not answer an anonymous request](https://shipreadyai.dev/learn/findings/o12-storage-ok.md): The bucket listing did not come back to a request holding only the browser key.
- [Any site can read your responses with a visitor's session](https://shipreadyai.dev/learn/findings/o13-cors-open-credentials.md): {path} answered a request from an outside origin with an allow origin of {origin} and credentials allowed, so a page on another domain can read responses using your visitor's session.
- [Cross origin reads are open to every site](https://shipreadyai.dev/learn/findings/o13-cors-wildcard.md): {path} answered with an allow origin of {origin}, so any site can read what it returns. Without credentials that is only a problem for data you did not mean to publish.
- [Cross origin rules are narrow or absent](https://shipreadyai.dev/learn/findings/o13-cors-ok.md): A request from an outside origin came back without a header inviting other sites to read the response.
- [The domain registration comes up for renewal](https://shipreadyai.dev/learn/findings/o14-domain-renewal-due.md): The public registry record says {domain} expires on {expiry}, which is {days} days away. That is close enough to put a renewal on the calendar now.
- [The domain registration expires soon](https://shipreadyai.dev/learn/findings/o14-domain-expiring.md): The public registry record says {domain} expires on {expiry}, which is {days} days away. An expired domain takes the app, the mail, and the sign in links with it.
- [The domain registration has time left](https://shipreadyai.dev/learn/findings/o14-domain-ok.md): The public registry record says {domain} expires on {expiry}, {days} days away.
- [The app runs on a shared platform domain](https://shipreadyai.dev/learn/findings/o14-domain-shared.md): {domain} belongs to the hosting platform, so there is no registration of yours to expire and no registry record to read.
- [The Firebase database answers without a sign in](https://shipreadyai.dev/learn/findings/o15-firebase-database-open.md): A plain request to {endpoint} returned data with no sign in, so the rules on that database let anonymous readers in.
- [Firebase storage listed its contents without a sign in](https://shipreadyai.dev/learn/findings/o15-firebase-storage-open.md): A plain request to {endpoint} returned an object listing with no sign in, so anyone can enumerate what is stored.
- [Firestore collections answer without a sign in](https://shipreadyai.dev/learn/findings/o15-firestore-open.md): Requests with no sign in came back with documents from these collections: {collections}. ShipReady records the collection names and the counts and never keeps a document.
- [Firebase endpoints did not answer an anonymous request](https://shipreadyai.dev/learn/findings/o15-firebase-ok.md): The database and storage endpoints refused a request that carried no sign in.
- [Anyone can create an account](https://shipreadyai.dev/learn/findings/o16-signup-open.md): The public auth settings at {endpoint} report that self signup is on, so a script can create accounts at will.
- [New accounts are confirmed automatically](https://shipreadyai.dev/learn/findings/o16-email-confirmation-info.md): The public auth settings report that new sign ups are confirmed automatically, so an account can be created with an address the person does not own. You did not declare customer data, so this is recorded rather than raised.
- [Anonymous sign in is turned on](https://shipreadyai.dev/learn/findings/o16-anonymous-signin.md): The public auth settings at {endpoint} report anonymous sign in is on, so a caller can hold a session without ever giving an address. That is fine when it is deliberate and a problem when row rules assume a known person.
- [New accounts are active before the address is confirmed](https://shipreadyai.dev/learn/findings/o16-email-confirmation-off.md): The public auth settings report that new sign ups are confirmed automatically, so an account can be created with an address the person does not own.
- [Sign in methods published by the backend](https://shipreadyai.dev/learn/findings/o16-auth-settings.md): The public auth settings list these sign in methods: {providers}.
- [The auth settings read as expected](https://shipreadyai.dev/learn/findings/o16-auth-ok.md): Self signup is closed and new accounts have to confirm their address.