How Ship-Ready Check works

Ship-Ready Check looks at the public side of a web app the way a browser, a search engine and a payment reviewer would, and tells you what to fix before you start taking money. 简体中文说明见下方。

What it loads

• Your home page and the scripts, styles and icon it loads (same site only).
• /robots.txt and your sitemap.
• A few well-known paths: /.env, /.env.local, /.env.production, /.git/HEAD, /.git/config, and common legal paths like /terms when they aren't linked.
• Source map files next to your scripts.
• Up to 20 internal links found on your home page, and one made-up URL to see how your 404 page answers.

Every request is a plain GET, at most 36 per run, spaced out. It never logs in, submits forms, sends payloads or measures load. Extra paths respect your robots.txt. Requests identify themselves as ShipReadyCheck/1.0.

Who can be checked

Before every run you confirm that you own the site or are allowed to check it. Local and private network addresses (localhost, 10.x, 192.168.x, 169.254.x, IPv6 local ranges and similar) are refused, including when a public name points to one or a redirect leads to one.

What's in the report

25 checks in six groups: connection and headers, keys and public files, what payment providers look for, search and sharing, speed and polish, and analytics and consent. Each check shows pass, warn or fail, the evidence seen, and a fix with copy-paste snippets for Next.js, Vite, Lovable + Supabase, Cloudflare Pages and Vercel. Keys we spot are masked (for example sk_live_••••••1a2b); full values are never stored or shown.

What it can't see

Pages behind a login, database rules (such as Supabase Row Level Security), payment webhooks and server code. Treat a good score as "the public side looks ready", not as a full review.

What we keep

The report (URL and results) for 30 days, so its share link works. To keep the tool fair we count runs per IP address and per checked site for one hour; those counters expire on their own. No account, no tracking cookies.

简体中文

Ship-Ready Check 只读取网站公开的部分：首页及其加载的同站脚本、样式和图标，robots.txt 与 sitemap，几个常见路径（如 /.env、/.git/HEAD、/terms），脚本旁的 source map，首页上最多 20 个内部链接，以及一个随机网址用来测试 404。全部是普通 GET 请求，每次最多 36 次并保持间隔，遵守 robots.txt，不登录、不提交表单、不做压测。

每次检查前需要确认网站是你的或你已获得许可。本地与内网地址一律拒绝。报告中发现的密钥会打码显示，不保存完整值。报告保存 30 天以便分享；按 IP 和网站的每小时计数一小时后自动过期。

Contact

XyneX · byouka2024@gmail.com · X @xynex_llc