Production-readiness audit · automated

Should it launch?

Find out before your client does. Paste a URL and we scan an AI-built site for leaked keys, dead forms, and broken access controls a demo never shows.

3 free scans a day. No card, no account.

01 · The Moon

What a demo hides

It looked finished on the call. The bundle holds a service_role key, the contact form posts nowhere, the public key reads tables it never should. A click-through shows none of it.

02 · Mars

Evidence, not opinions

SIL-01 · DOSSIERNOT READY

A live service_role key is exposed in the client bundle.

assets/index-4f1c2a.js:1
const supabase = createClient(url,
  "eyJhbGci…role:service_role")

03 · The belt

The small stuff still sinks you

A missing alt attribute. A console error left in. A meta tag pointing nowhere. None of it sinks a demo. All of it lands in the audit.

04 · Jupiter

Eight dimensions, every pass

Security
Functional
Accessibility
Performance
SEO
Privacy
AI-tells
Responsive

Every finding carries the line of code that proves it.

05 · Saturn

One verdict, and you can trust it

Ship, ship with fixes, or not ready. The call sits at the top, above every finding. The gate is tuned so a false ship costs far more than a missed nit, so a clear is a real clear.

06 · Uranus

The report you hand over

White-label, your name on it, exportable as a PDF. Give it to the client as your own work, or keep it as the punch list you clear before they ever see the site.

07 · Neptune

A verdict in seconds

Paste the URL and the scan runs while you wait. The full audit, across all eight dimensions, comes back in seconds. No sending the site out and waiting days for a manual once-over.

08 · Pluto · the edge

Know before
you hand it over.

3 free scans a day. No card, no account.

/ 01 · Sample report

The report you hand the client.

Fictional client, real findings. This is the actual document, in miniature.

Subject of Audit

harborandvine.example

captured 2026·06·19 11:42 utc · built on Lovable · engine v1.0 · ruleset r1

The verdict

One blocking issue: a private database key is exposed in the site's code, which hands anyone who opens the page full read and write access to your data. Security also sits below our release floor.

criticals: 1 floor breached: security gate → not ready

Readiness index

57/100

the index is diagnostic. the gate verdict above is what governs release.

Audit Coverage · 8 dimensions

Accessibility723 fail
Security241 crit
Performance & Core Web Vitals58diag
SEO & Structured Data662 fail
AI-tell / Slop385 fail
Functional Integrity443 fail
Privacy & Legal Hygiene70info
Responsive / Mobile632 fail

critical SEC-SECRET-01 FAIL

Supabase service_role key exposed in the page bundle

The service_role key bypasses every row-level-security rule. Anyone who opens the site can read, edit, and delete your entire database from their browser.

location /assets/index-4f1c2a.js:1
value eyJhbGciOiJIUzI1Ni…EXAMPLE · redacted in every hosted copy

fix prompt · suggestion-gradepaste into the tool that built this site

Remove the Supabase service_role key from all client-side code. It must never appear in the browser bundle. First rotate it: in the Supabase dashboard go to Settings, API, and reset the service_role key, since the current one is exposed and must be treated as compromised. …

pass

pk_live_51Q8t… is a Stripe publishable key. Public by design. Not a leak, not flagged.

Read the full sample report

Every section above continues in the full document: all eight dimensions, every finding, every fix prompt.

/ 02 · Why it matters

Sites built on v0, Lovable, Bolt, Replit, Cursor, or Claude look done in the demo.

They ship with leaked keys, dead forms, broken links, and placeholder text the generator left behind. A demo hides all of it. A paying client, clicking around on launch day, finds it for you. Here is what each one costs, and the check that catches it.

A leaked service_role key SEC-SECRET-01: Anyone who opens the browser console can read and write the client's database. You hear about it from them, not from us.
A form with no handler FUNC-FORM: Every lead the client was promised goes nowhere. The form looks fine, and the build takes the blame.
A 404 on checkout or nav FUNC-LINK: Lost sales and a support thread with your name on it, on the first day the site is live.
A "Vite App" title, lorem ipsum E1-DEFAULT-TITLE: The client sees unfinished work before you catch it, and the invoice gets harder to send.

/ 03 · How it works

From URL to verdict in one pass.

Nothing to install, no agent on the site. The audit runs against a real rendered capture of the page.

T-0 · input
Paste the URL

The site you are about to deliver, exactly as it stands.
flight · scan
The engine flies the page

A real render, eight dimensions in one pass, evidence attached to every finding.
landing · verdict
The verdict is filed

Ship, ship with fixes, or not ready. In your browser in minutes, ready to export. White-label on Pro.

3 free scans a day. No card, no account. The full report is $39.

/ 04 · Pricing

Pricing: $39One report, or every site you ship.

If the audit can't run, you aren't charged. Re-scans to prove your fixes landed are free. No call to see what we charge.

One-off report

$39once

One full rendered audit, all eight dimensions
Free re-scans until your fixes land
Yours to keep, private or shared by link

Run an audit

Pro · the agency tier

$79/mo

15 new sites a month
White-label reports, your name on the masthead
Monitoring: re-audits on schedule and on deploy
Unlimited free re-scans · cancel anytime

Get Pro

the embeddable launch mark · for sites that pass

/ 05 · Our report

We ship through the same gate.

Our own audit, read live from the same system. If we regress, this section says so before we do.

verdict Unverified

Production-Readiness · shoulditlaunch.com

No published audit to show yet. This card resolves through the gate we sell, and it claims nothing it can't prove.

resolved live · never cached · fails to this state, not to green