Observed
ShipReady verified it directly against your live app.
What we check, and what we don't
The free Launch Risk Check reads your app from the outside: the redirect and certificate, protective response headers, source maps, secrets left in client JavaScript, exposed paths, cookies, email records, legal pages, file storage, cross origin rules, the domain registration, Firebase endpoints and the backend sign in settings. It never signs in, never writes anything, never calls your functions, and never reads the contents of your database.
Four statuses. No scores.
Detected
The fingerprint found it in the app's pages or bundles.
Declared
The owner confirmed or corrected it. It appears as their statement, not as fact.
Not verified
Needs code, runtime, or authenticated access. This is the work of a Launch Review.
The external checks
- Whether http redirects to https and whether the certificate is valid.
- Which protective response headers are present and which are missing.
- Whether source maps are publicly reachable.
- Whether server-side secrets are bundled into client JavaScript. Public keys, such as a Supabase anon key or a Stripe publishable key, are never counted as leaks.
- Whether common sensitive paths are exposed.
- Which technologies are detectable from the outside.
- Whether the host publishes platform trust evidence at its well-known trust address.
- Whether database tables answer an anonymous request, reported as counts and table names, never row contents.
- Whether file storage lists its buckets to an anonymous request, and which buckets are marked public.
- Whether the app invites other sites to read its responses, and whether it allows them to do so with a visitor's session.
- When the domain registration expires, read from the public registry record.
- Whether Firebase database and storage endpoints answer without a sign in.
- What the backend publishes about sign in: whether anyone can create an account, whether new accounts are confirmed automatically, and which providers are on.
What we never do
- No scores.
- No badges.
- No stored secrets.
- No stored row contents.
- No checks without your authorization.
- No calling your functions.
- No creating accounts and no signing in.
Can I get a badge or certificate?
- No. Nothing on this site certifies an app, and no automated check can.
Launch checklists
- Build a checklist for your own stack with the launch checklist generator.
- Or read the production readiness checklist.
- See the common vibe coding security risks and how to audit AI-generated code.
Retention and limits
- Check records are kept for 90 days, then deleted.
- Five checks per connection per hour.
- The same URL checked again within 10 minutes returns the existing results instead of running again.
- To have a record removed sooner, email Alex@techtideai.io from an address connected to the app.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated October 29, 2026