KevickLog inVerify my site ↗

Sample report

What Kevick tells you

This site returned a page. The page was not the product. That is the gap a status check cannot see, and it is what the report below found.

A sample report — and it is not your product

The site verified below is our own test deployment. We created this-app-does-not-exist-launchvet-test.vercel.app and never deployed anything to it, so it answers with the hosting platform’s error page instead of an application. We broke it on purpose so you can see what a failure looks like.

Everything below is a real run of the real engine on 4 August 2026, read out of the database exactly as it was stored. No part of this page is illustrative, and no number on it was written by hand.

One thing a live report shows that this one cannot: the page’s own title and description. The engine reads them but does not store them, so they are absent here rather than reconstructed.

verification f680b93e-95a9-47bc-81ec-c06afaf40125

What was verified

You submitted
https://this-app-does-not-exist-launchvet-test.vercel.app
Probed
this-app-does-not-exist-launchvet-test.vercel.app
Response served from
https: https://this-app-does-not-exist-launchvet-test.vercel.app

What you submitted is what was probed, and the response came from that same host.

Verification of this-app-does-not-exist-launchvet-test.vercel.app

A critical-tier layer failed verification.

  • Layer technical is fail (critical tier)

Verdict

Blocked

Rule 1 · rule set version 2

What this run covered

2 of 8 layers were examined, by 15 checks across 2 catalogs, and 2 of those reached a conclusion. Examined means a detector ran and reported what it found, not that the layer was cleared. This is surface-level verification from a public URL — it is not a full assessment, and it is not a guarantee.

  • transport-security · catalog v2 · 10 checks
  • technical · catalog v1 · 5 checks

Verified

Security, Technical

  • Not run: Authentication, sessions and cookies

  • Not run: Database access, permissions and data isolation

Not run

No checks recorded — Business, Launch, Operations, Performance, Quality, Reliability. This run recorded no checks on these, so nothing was concluded about them. That is a fact about what Kevick recorded when the run was made, not a finding about your product.

They are reported as unverified, which means nobody checked. It is not a pass and it is not a failure.

Findings (5)

High · 1

  • MisconfiguredHigh
    Confidence 85/100 · Directly observed

    The page served is a hosting-platform error, not your product

    The response claimed success, but the page returned is the error screen your hosting platform shows when an application crashes. Visitors see a platform error instead of your product, and because the status code says everything is fine, uptime monitors that only check status codes will not notice.

    What we observedGEThttps://this-app-does-not-exist-launchvet-test.vercel.app
    document contains "DEPLOYMENT_NOT_FOUND"
    How to fix it

    This is your application failing at runtime rather than your host failing. Open your platform's function or server logs for the failing invocation — the stack trace there names the cause. Common causes are a missing environment variable in the production environment, a database connection that works locally but not from the deployed region, and a build that succeeded while the runtime import failed. Verify by loading the page and confirming your own content renders.

    Referencetech.platform_error_document

Medium · 2

  • MissingMedium
    Confidence 90/100 · Directly observed

    Content-Security-Policy header is missing

    A content security policy limits where scripts may load from. Without one, a single injected script — from a compromised dependency or user-supplied content — can run with full access to your page and your users' sessions.

    What we observedGEThttps://this-app-does-not-exist-launchvet-test.vercel.app
    content-security-policy not present on the response
    How to fix it

    Send a `Content-Security-Policy` header, starting with `Content-Security-Policy-Report-Only` so you can see what would break before enforcing it. Begin with `default-src 'self'` and widen it deliberately for the origins you actually use. Set it wherever your responses get their headers — your framework's header configuration, your web server, or your CDN or host's header rules.

    Referencetransport.csp_missing

  • MissingMedium
    Confidence 90/100 · Directly observed

    No protection against being embedded in a frame

    Without a frame policy, an attacker can load your site invisibly inside their own page and trick users into clicking things they cannot see — approving a payment or changing a setting. This is clickjacking.

    What we observedGEThttps://this-app-does-not-exist-launchvet-test.vercel.app
    x-frame-options not present on the response
    How to fix it

    Send `X-Frame-Options: DENY`, or the modern equivalent `Content-Security-Policy: frame-ancestors 'none'`. Use `SAMEORIGIN` / `frame-ancestors 'self'` instead if you legitimately embed your own pages. Either header satisfies this check.

    Referencetransport.frame_protection_missing

Low · 2

  • MissingLow
    Confidence 90/100 · Directly observed

    X-Content-Type-Options header is missing

    Browsers will sometimes guess a file's type rather than trust the one you declared. A file you serve as plain text can be guessed to be a script and executed. This matters most where users upload files.

    What we observedGEThttps://this-app-does-not-exist-launchvet-test.vercel.app
    x-content-type-options not present on the response
    How to fix it

    Send `X-Content-Type-Options: nosniff` on all responses. It has one value, no downside, and takes a single line in your header configuration.

    Referencetransport.content_type_options_missing

  • MissingLow
    Confidence 90/100 · Directly observed

    Referrer-Policy header is missing

    By default browsers tell the sites your users click through to which page they came from. If your URLs contain reset tokens, invite codes or account identifiers, those leak to third parties in the Referer header.

    What we observedGEThttps://this-app-does-not-exist-launchvet-test.vercel.app
    referrer-policy not present on the response
    How to fix it

    Send `Referrer-Policy: strict-origin-when-cross-origin`. This keeps full referrer information within your own site and sends only the origin to third parties.

    Referencetransport.referrer_policy_missing

Layers

All eight are listed. Separating them keeps a run from reading as eight things checked when one was.

Overall score — not available

2 of 8layers could be scored. An overall score would describe the whole product, and this run measured part of it — so there isn't one to show. The per-layer scores below are real.

Examined (2 of 8)

A detector ran on these. Some can still read unverified — that means it looked and could not reach a conclusion, which is a limit on the evidence, not a finding about your product.

  • L2TechnicalCritical
    83 / 100Fail
    Confidence 85/100 · High
  • L3SecurityCritical
    84 / 100Caution
    Confidence 90/100 · High

Not checked (6)

Unverified here means nobody checked — it is not a pass, and it is not a failure. A critical-tier layer left unverified is why a verdict can come back as unable to determine.

No checks recorded

This run recorded no checks on these, so nothing was concluded about them. That is a fact about what Kevick recorded when the run was made, not a finding about your product.

  • L1QualityAdvisory
    no score — nothing measurableUnverified
    Confidence 0/100 · Low
  • L4ReliabilityCritical
    no score — nothing measurableUnverified
    Confidence 0/100 · Low
  • L5PerformanceImportant
    no score — nothing measurableUnverified
    Confidence 0/100 · Low
  • L6OperationsImportant
    no score — nothing measurableUnverified
    Confidence 0/100 · Low
  • L7BusinessAdvisory
    no score — nothing measurableUnverified
    Confidence 0/100 · Low
  • L8LaunchAdvisory
    no score — nothing measurableUnverified
    Confidence 0/100 · Low

Run this against your own site

Same engine, same checks, same report — pointed at your product instead of ours. It is free while we measure what it costs to run, and there is nothing to buy.

Verify my site — freeLog in

When this run was made, on 4 August 2026, 6 of these 8 layers had no detector. We would rather show you that than imply we checked them. Coverage has changed since — your own run will say what it covered.