Observed
ShipReady verified it directly against your live app.
Free check
Scan a live URL for what the outside world can see
No account, no code, no credentials. Paste the public address of your app and answer six short questions. Results take about twenty seconds.
What the scan reads
Redirect and certificate
Whether http moves to https, and whether the certificate is valid for the hostname.
Response headers
Content security policy, strict transport security, frame options, content type options, referrer policy and permissions policy, present or missing.
Source maps
Whether the map files your bundles reference can be downloaded by anyone.
Secrets in client JavaScript
Server side keys bundled into the code you ship. Publishable keys, such as a Supabase anon key or a Stripe publishable key, are never counted as leaks.
Common sensitive paths
A short list of well known addresses that should not answer, such as environment files and debug endpoints.
Detectable technologies
What your stack reveals about itself from the outside.
Published trust evidence
Whether your host publishes platform trust information at its well known trust address.
Three statuses. No scores, no badges.
Every finding lands in one of three lists, so you always know how much weight it carries.
Declared
You told us. It appears as your statement, not as fact.
Not verified
Needs code, runtime, or authenticated access. This is the work of a Launch Review.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.