Observed
ShipReady verified it directly against your live app.
What we check, and what we don't
Three statuses. No scores.
Declared
You told us. It appears as your statement, not as fact.
Not verified
Needs code, runtime, or authenticated access. This is the work of a Launch Review.
The external checks
- Whether http redirects to https and whether the certificate is valid.
- Which protective response headers are present and which are missing.
- Whether source maps are publicly reachable.
- Whether server-side secrets are bundled into client JavaScript. Public keys, such as a Supabase anon key or a Stripe publishable key, are never counted as leaks.
- Whether common sensitive paths are exposed.
- Which technologies are detectable from the outside.
- Whether the host publishes platform trust evidence at its well-known trust address.
What we never do
- No scores.
- No badges.
- No stored secrets.
- No stored row contents.
- No checks without your authorization.
Retention and limits
- Check records are kept for 90 days, then deleted.
- Five checks per connection per hour.
- The same URL checked again within 10 minutes returns the existing results instead of running again.
- To have a record removed sooner, email Alex@techtideai.io from an address connected to the app.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.