Log inRequest access

Sample report

What Kevick tells you

This site returned a page. The page was not the product. That is the gap a status check cannot see, and it is what the report below found.

A sample report — and it is not your product

The site examined below is our own test deployment. We created this-app-does-not-exist-launchvet-test.vercel.app and never deployed anything to it, so it answers with the hosting platform’s error page instead of an application. We broke it on purpose so you can see what a failure looks like.

Everything below is a real run of the real engine on 4 August 2026, read out of the database exactly as it was stored. No part of this page is illustrative, and no number on it was written by hand.

One thing a live report shows that this one cannot: the page’s own title and description. The engine reads them but does not store them, so they are absent here rather than reconstructed.

run f680b93e-95a9-47bc-81ec-c06afaf40125

Skip to what to fix

Blocked

One problem stops your launch.

Report on this-app-does-not-exist-launchvet-test.vercel.app

Kevick reached a conclusion on 2 of 8 layers. It did not check the other 6.

5

things to fix

  • 1  Fix before launch
  • 2  Fix soon
  • 2  Fix when you can

Start with the ones marked "Fix before launch". This list covers only what Kevick could examine. See below for what it couldn't.

What to fix

Most urgent first

  1. Fix before launch

    The problem

    The page served is a hosting-platform error, not your product

    The response claimed success, but the page returned is the error screen your hosting platform shows when an application crashes. Visitors see a platform error instead of your product, and because the status code says everything is fine, uptime monitors that only check status codes will not notice.

    Kevick sawGET https://this-app-does-not-exist-launchvet-test.vercel.app
    document contains "DEPLOYMENT_NOT_FOUND"

    Confidence 85/100 · High confidence · Directly observed

    High · Misconfigured

    Referencetech.platform_error_document

    Do this

    This is your application failing at runtime rather than your host failing. Open your platform's function or server logs for the failing invocation — the stack trace there names the cause. Common causes are a missing environment variable in the production environment, a database connection that works locally but not from the deployed region, and a build that succeeded while the runtime import failed. Verify by loading the page and confirming your own content renders.

  2. Fix soon

    The problem

    Content-Security-Policy header is missing

    A content security policy limits where scripts may load from. Without one, a single injected script — from a compromised dependency or user-supplied content — can run with full access to your page and your users' sessions.

    Kevick sawGET https://this-app-does-not-exist-launchvet-test.vercel.app
    content-security-policy not present on the response

    Confidence 90/100 · High confidence · Directly observed

    Medium · Missing

    Referencetransport.csp_missing

    Do this

    Send a `Content-Security-Policy` header, starting with `Content-Security-Policy-Report-Only` so you can see what would break before enforcing it. Begin with `default-src 'self'` and widen it deliberately for the origins you actually use. Set it wherever your responses get their headers — your framework's header configuration, your web server, or your CDN or host's header rules.

  3. Fix soon

    The problem

    No protection against being embedded in a frame

    Without a frame policy, an attacker can load your site invisibly inside their own page and trick users into clicking things they cannot see — approving a payment or changing a setting. This is clickjacking.

    Kevick sawGET https://this-app-does-not-exist-launchvet-test.vercel.app
    x-frame-options not present on the response

    Confidence 90/100 · High confidence · Directly observed

    Medium · Missing

    Referencetransport.frame_protection_missing

    Do this

    Send `X-Frame-Options: DENY`, or the modern equivalent `Content-Security-Policy: frame-ancestors 'none'`. Use `SAMEORIGIN` / `frame-ancestors 'self'` instead if you legitimately embed your own pages. Either header satisfies this check.

  4. Fix when you can

    The problem

    X-Content-Type-Options header is missing

    Browsers will sometimes guess a file's type rather than trust the one you declared. A file you serve as plain text can be guessed to be a script and executed. This matters most where users upload files.

    Kevick sawGET https://this-app-does-not-exist-launchvet-test.vercel.app
    x-content-type-options not present on the response

    Confidence 90/100 · High confidence · Directly observed

    Low · Missing

    Referencetransport.content_type_options_missing

    Do this

    Send `X-Content-Type-Options: nosniff` on all responses. It has one value, no downside, and takes a single line in your header configuration.

  5. Fix when you can

    The problem

    Referrer-Policy header is missing

    By default browsers tell the sites your users click through to which page they came from. If your URLs contain reset tokens, invite codes or account identifiers, those leak to third parties in the Referer header.

    Kevick sawGET https://this-app-does-not-exist-launchvet-test.vercel.app
    referrer-policy not present on the response

    Confidence 90/100 · High confidence · Directly observed

    Low · Missing

    Referencetransport.referrer_policy_missing

    Do this

    Send `Referrer-Policy: strict-origin-when-cross-origin`. This keeps full referrer information within your own site and sends only the origin to third parties.

What Kevick looked at

2 of 8 layers examined
  1. 1SecurityCriticalConfidence 90/100 · High84 / 100Needs attention
  2. 2TechnicalCriticalConfidence 85/100 · High83 / 100Problem found
  3. 3QualityAdvisoryLook yourself: use it start to finish like a new user.no score — nothing measurableNot checked
  4. 4BusinessAdvisoryLook yourself: test sign-up, payment and cancelling.no score — nothing measurableNot checked
  5. 5LaunchAdvisoryLook yourself: check people can reach you.no score — nothing measurableNot checked
  6. 6ReliabilityCriticalLook yourself: set up a free uptime alert.no score — nothing measurableNot checked
  7. 7PerformanceImportantLook yourself: open it on a phone.no score — nothing measurableNot checked
  8. 8OperationsImportantLook yourself: decide how you would learn something broke.no score — nothing measurableNot checked

The small print

What this report did and did not read
What was examined
You submitted
https://this-app-does-not-exist-launchvet-test.vercel.app
Probed
this-app-does-not-exist-launchvet-test.vercel.app
Response served from
https: https://this-app-does-not-exist-launchvet-test.vercel.app

What you submitted is what was probed, and the response came from that same host.

What this run covered

2 of 8 layers were examined, by 15 checks across 2 catalogs, and 15 of those reached a conclusion. Examined means a detector ran and reported what it found, not that the layer was cleared. This is a surface-level check from a public URL — it is not a full assessment, and it is not a guarantee.

  • transport-security · catalog v2 · 10 checks
  • technical · catalog v1 · 5 checks
Reached a conclusion

Security, Technical

  • Not run: Authentication, sessions and cookies
  • Not run: Database access, permissions and data isolation
Kevick did not check these in this run

No checks recorded — Business, Launch, Operations, Performance, Quality, Reliability. This run recorded no checks on these, so nothing was concluded about them. That is a fact about what Kevick recorded when the run was made, not a finding about your product.

That is not a pass and not a failure.

Verdict

A critical-tier layer failed verification.

  • Layer technical is fail (critical tier)

Rule 1 · rule set version 2

Overall score — not available

2 of 8 layers show a score. A layer shows one only when every check on it reached a conclusion. An overall score would need all eight, so there isn't one.

Run this against your own site

Same engine, same checks, same report — pointed at your product instead of ours. It is free while we measure what it costs to run, and there is nothing to buy.

Log inRequest access

When this run was made, on 4 August 2026, 6 of these 8 layers had no detector. We would rather show you that than imply we checked them. Coverage has changed since — your own run will say what it covered.

Want deeper checks?

Kevick can’t read your code yet.

Follow @kevick_ai