Responsible use
The free scan is a careful fetch of a public URL. The later tests require proof that you control the app.
Scan your own app
Use ReadyToLaunch on sites you own or have written permission to test. Do not use it to hunt for data in someone else's product. We rate-limit free scans. We do not send traffic to a target's Supabase API in this release.
Opt out
For unverified URL scans we honor robots.txt for User-agent: ReadyToLaunchBot. A Disallow: / stops the scan. You can also publish a non-HTML file at /.well-known/readytolaunch-optout. Details are on the bot page.
Reporting a problem in ReadyToLaunch
Email security@readytolaunch.cc. We aim to acknowledge mail within two business days. Give us a reasonable window to fix a critical issue before you publish it. Do not access other people's data, do not run denial-of-service tests, and do not use social engineering. We will not pursue legal action against someone who follows this policy. See also security.txt.
What we will not claim
Supabase Security Advisor and other scanners already exist. ReadyToLaunch does not replace them. A Ship-Ready Score is a checklist with a number, not a certificate. We are not SOC 2.