Skip to content
ShipReady

Not verified

Sign in and account flows

Whether sign in, password or code reset, and session expiry behave under real use.

Last updated September 20, 2026

Needs a signed-in account

Why a check from outside cannot see it

A check never signs in. It has no account, no password and no permission to create one, so every behaviour behind the login is out of reach by design.

How to check it yourself

  1. 1Create two accounts and sign in to each in a different browser.
  2. 2Copy a private address from the first account and open it in the second.
  3. 3Then try the same through the API rather than the interface, because the two often disagree.

Sign in as two different accounts in two browsers and try to open the other account's pages by address.

What a Launch Review does instead

Launch Review, $199

A reviewer signs in with two accounts, crosses the boundary on purpose, and checks session expiry and reset behaviour.

See what a Launch Review covers

Incidents that involved this

  • Not verified

    First-quarter 2026 assessment of 200 apps

    183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.

    2026-04
    Read the incident
  • Not verified

    Tenzai study of AI-built apps

    69 vulnerabilities across 15 apps built by five AI coding tools.

    2026-02
    Read the incident
  • Not verified

    Tea app, second breach

    Three days after the first breach, over a million private messages were exposed through an API endpoint with no access control.

    2025-07
    Read the incident
  • Not verified

    Base44 authentication flaw

    A platform-wide authentication flaw allowed access to private enterprise data.

    2025-01
    Read the incident

See all nine items

ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.

Last updated September 20, 2026