What we check, and what we don't

Four statuses. No scores.

The external checks

• Whether http redirects to https and whether the certificate is valid.
• Which protective response headers are present and which are missing.
• Whether source maps are publicly reachable.
• Whether server-side secrets are bundled into client JavaScript. Public keys, such as a Supabase anon key or a Stripe publishable key, are never counted as leaks.
• Whether common sensitive paths are exposed.
• Which technologies are detectable from the outside.
• Whether the host publishes platform trust evidence at its well-known trust address.
• Whether database tables answer an anonymous request, reported as counts and table names, never row contents.
• Whether file storage lists its buckets to an anonymous request, and which buckets are marked public.
• Whether the app invites other sites to read its responses, and whether it allows them to do so with a visitor's session.
• When the domain registration expires, read from the public registry record.
• Whether Firebase database and storage endpoints answer without a sign in.
• What the backend publishes about sign in: whether anyone can create an account, whether new accounts are confirmed automatically, and which providers are on.

What we never do

• No scores.
• No badges.
• No stored secrets.
• No stored row contents.
• No checks without your authorization.
• No calling your functions.
• No creating accounts and no signing in.

Can I get a badge or certificate?

• No. Nothing on this site certifies an app, and no automated check can.

Launch checklists

• Build a checklist for your own stack with the launch checklist generator.
• Or read the production readiness checklist.

Retention and limits

• Check records are kept for 90 days, then deleted.
• Five checks per connection per hour.
• The same URL checked again within 10 minutes returns the existing results instead of running again.
• To have a record removed sooner, email Alex@techtideai.io from an address connected to the app.