← ShipLatch · Full sample (Fix Pack view) · What we check

SAMPLE · This is a sample: the free scan view of our own fictional demo app (demo-typical.shiplatch.com), scanned live by the real ShipLatch scanner. Nothing in it is secret.

Sample report: a typical first scan

B
https://demo-typical.shiplatch.com/
Free scan view · score 81/100 · scanned live by the production scanner (2026-10-20 17:56 UTC)
0 critical0 high2 medium1 low
What the severity levels mean
CriticalSomeone can likely take your data or take control right now.
HighSomeone could use this against your app today.
MediumWeakens your defenses, but needs a second mistake to exploit.
LowGood hygiene. Little direct risk on its own.

No leaked keys and no exposed files: just two missing security headers and a public source map. The free scan gives you the source-map fix and the copy-paste header fix below.

Findings

Medium No Content-Security-Policy header
Without this header, an injected script has an easier time stealing user sessions.
Add a Content-Security-Policy.
🔒 In your Fix Pack, this is written for your exact file and key.
Vercel (vercel.json)
{
Netlify (public/_headers, or netlify.toml below)
/*
Cloudflare Pages (public/_headers)
/*
Prompt for your AI builder
Add these HTTP security headers to every response my app serves (all routes, including the HTML page). Use my hosting's config file (vercel.json headers, a public/_headers file for Netlify or Cloudflare Pages, or netlify.toml). Don't change any app code.
Medium No HSTS (Strict-Transport-Security) header
Browsers may still connect over plain HTTP, which can be intercepted.
Add Strict-Transport-Security: max-age=31536000; includeSubDomains
🔒 In your Fix Pack, this is written for your exact file and key.
Vercel (vercel.json)
{
Netlify (public/_headers, or netlify.toml below)
/*
Cloudflare Pages (public/_headers)
/*
Prompt for your AI builder
Add these HTTP security headers to every response my app serves (all routes, including the HTML page). Use my hosting's config file (vercel.json headers, a public/_headers file for Netlify or Cloudflare Pages, or netlify.toml). Don't change any app code.
Low 1 source map(s) publicly served; your original source code is readableFree on every scan
Your original source code is readable, which makes bugs and secrets easier to find.
Disable production source maps (e.g. Vite build.sourcemap=false) or don't upload .map files.
Free fix: add the missing security headers
Copy the block for your host, deploy, then scan again. The CSP here is a safe starter that won't block your scripts.
Vercel (vercel.json)
{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Content-Security-Policy",
          "value": "frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests"
        },
        {
          "key": "Strict-Transport-Security",
          "value": "max-age=31536000; includeSubDomains"
        },
        {
          "key": "X-Frame-Options",
          "value": "SAMEORIGIN"
        },
        {
          "key": "X-Content-Type-Options",
          "value": "nosniff"
        },
        {
          "key": "Referrer-Policy",
          "value": "strict-origin-when-cross-origin"
        }
      ]
    }
  ]
}
Netlify (public/_headers, or netlify.toml below)
/*
  Content-Security-Policy: frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  X-Frame-Options: SAMEORIGIN
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin

# or in netlify.toml:
[[headers]]
  for = "/*"
  [headers.values]
    Content-Security-Policy = "frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests"
    Strict-Transport-Security = "max-age=31536000; includeSubDomains"
    X-Frame-Options = "SAMEORIGIN"
    X-Content-Type-Options = "nosniff"
    Referrer-Policy = "strict-origin-when-cross-origin"
Cloudflare Pages (public/_headers)
/*
  Content-Security-Policy: frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  X-Frame-Options: SAMEORIGIN
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
Prompt for your AI builder
Add these HTTP security headers to every response my app serves (all routes, including the HTML page). Use my hosting's config file (vercel.json headers, a public/_headers file for Netlify or Cloudflare Pages, or netlify.toml). Don't change any app code.
Content-Security-Policy: frame-ancestors 'self'; object-src 'none'; base-uri 'self'; upgrade-insecure-requests
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Keep it at this grade every deploy
Stay Locked re-scans your app on every deploy and daily, and emails you if the grade drops or a key leaks.
Stay Locked · $15/month
Keep my grade with Stay LockedScan your own app free
Scan your app free

TypicalTodo is a fictional app run by ShipLatch for this sample. Viewing this page never unlocks or buys anything.