Not verified
Rollback and recovery
Whether you can put the previous version back, and how long that takes.
What we cannot see, and say so
A check runs from the street. It sees the front of the building. These nine items are inside, and no honest scan of a public address can report on them. Every one of them gets a page here that tells you how to check it yourself.
17 itemsLast updated September 13, 2026
- Not verified
Error monitoring
Whether a failure in production reaches a human rather than sitting in a log nobody opens.
- Not verified
Sign in and account flows
Whether sign in, password or code reset, and session expiry behave under real use.
- Not verified
Rate limiting and abuse controls
Whether a script can hammer your forms, sign up loop, or paid endpoints without being slowed down.
- Not verified
Key rotation
Whether you can replace a leaked key quickly and know everywhere it is used.
- Not verified
Payment handling
Whether payment events are verified, replay safe, and matched to the right customer record.
- Not verified
Customer data handling
Whether stored personal details are limited, deletable on request, and out of your logs.
- Not verified
AI feature controls
Whether prompts, spend, and model output are bounded so one visitor cannot run up the bill.
- Not verified
Database row rules
Whether the row rules behind the app actually stop one signed in account reading another's rows.
- Not verified
Certificate expiry date
Whether the certificate is close to expiring. A normal request proves the certificate is valid right now, and the runtime this check uses cannot read the expiry date from that request.
- Not verified
One account reading another account's data
Whether a signed in account can reach another account's records by changing an id. ShipReady does not create accounts, sign in, or call your functions, so this cannot be answered from outside.
- Not verified
How fast the page is for a real visitor
Whether the first screen arrives quickly on a phone connection. This check reads the page once from a server, which says nothing about what a visitor on a train sees.
- Not verified
Colour contrast in the interface
Whether text and controls stay readable against their background, including muted text, placeholders, disabled buttons and focus outlines.
- Not verified
How the layout holds on a phone
Whether the layout actually works at phone width. A viewport tag allows the page to adapt; it does not prove anything fits.
- Not verified
Whether your forms refuse automated submissions
Whether a script can post your public forms repeatedly. Sending test traffic at your forms is not something an outside check should do uninvited.
- Not verified
Whether the cookie choice is honoured
Whether a banner appears where it is required, and whether declining actually stops anything being stored.
- Not verified
Whether the first screen asks for one thing
Whether a visitor arriving cold knows the single next step. That is a judgement about your product, not something a request can read.
Check your app
Free. No signup. Evidence behind every result.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated October 29, 2026