Check the rendered page, not just the design mockup, so launch blockers are visible before traffic arrives.
Loading TrustDebt…
Checking trackers, legal paths, forms, and headers.
Loading TrustDebt…
Checking trackers, legal paths, forms, and headers.
AI builders rarely configure security headers. Your launch page is missing CSP, HSTS, and X-Frame-Options — and you don't know it. This checker audits headers, explains what's missing, and gives you a copy-paste fix for your framework.
No CSP means no script control
Missing HSTS exposes users to downgrade attacks
No X-Frame-Options means clickjacking is possible
This page is the deeper founder checklist. The scanner covers visible public-page signals; backend, auth, payments, and database risks still need human review.
Check the rendered page, not just the design mockup, so launch blockers are visible before traffic arrives.
Capture enough evidence that a founder, client, or developer knows exactly what needs to change.
Turn the finding into a specific remediation step instead of a vague compliance note.
Check the rendered page, not just the design mockup, so launch blockers are visible before traffic arrives.
Capture enough evidence that a founder, client, or developer knows exactly what needs to change.
Turn the finding into a specific remediation step instead of a vague compliance note.
Check the rendered page, not just the design mockup, so launch blockers are visible before traffic arrives.
For developers and founders launching AI-built apps on Vercel, Netlify, or Cloudflare, these are the gaps that make a launch feel risky once real visitors, clients, or paid traffic arrive.
Without CSP, any injected script can run on your page — XSS, malicious ads, or compromised dependencies.
Without HSTS, an attacker can force HTTP connections and intercept traffic before the redirect to HTTPS.
Your page can be embedded in an invisible iframe and used to trick users on other sites.
Most AI-built pages ship with zero security headers. No CSP. No HSTS. No X-Frame-Options. This is a missing security layer against XSS, clickjacking, MIME sniffing, and downgrade attacks. Lighthouse flags this as a best-practice violation.
Content Security Policy controls which scripts, styles, images, connections are allowed. Without CSP, any injected script can run — from compromised CDN, malicious ad, or supply chain attack. A starter CSP takes 5 minutes to deploy.
HTTP Strict Transport Security forces HTTPS. Without HSTS, an attacker on shared Wi-Fi intercepts the initial HTTP request. Google uses HSTS as a ranking signal and recommends preloading for production domains.
Next.js: next.config.js headers(). Netlify: _headers or netlify.toml. Vercel: vercel.json headers. Cloudflare: Transform Rules or Workers. TrustDebt's AI prompt includes the right config for your framework.
Yes. Google uses HTTPS and security posture as ranking signals. Pages with HSTS and CSP score higher on Lighthouse security audits, which correlates with better rankings.
It can if not tested. Start with Content-Security-Policy-Report-Only header to monitor violations without blocking. TrustDebt's fix prompt includes a safe starter CSP.
At minimum: CSP, HSTS (with preload), X-Frame-Options (or frame-ancestors in CSP), X-Content-Type-Options: nosniff, and Referrer-Policy. TrustDebt checks all of these.
Create a free account for 3 scans. Use the $29 Launch Audit when you need a written launch decision packet.