DEV Community

Launch Gate
Launch Gate

Posted on

What a launch-day check caught this week: 8 real examples

#showdev #productivity #startup #webdev

"I'll check it before launch" usually means clicking the homepage once on your own laptop. This week we ran passive checks against a few dozen freshly launched indie apps. None of it was intrusive: plain GET/HEAD requests to the site each project listed, reading status codes and headers. Here's what came up, roughly in order of how much it would hurt.

Things that break the launch itself

  1. The listed demo link returned 404. The project was active and the demo URL was still on its project page, but the hosted preview behind it no longer loaded.
  2. The site timed out twice in a row from a clean request. On launch day that reads as "dead project".
  3. A HEAD request returned 405. GET worked, but uptime monitors and link-preview bots often send HEAD first, then report the site as down or show no preview.
  4. The listed site was a design-tool page (a Figma Sites URL) rather than the product's own domain. That's fine for a mockup, but it's a fragile thing to send launch traffic to.

Baseline hardening that was simply missing

  1. No Content-Security-Policy header on most sites checked. It's not a vulnerability by itself, but it's the first thing a security-minded user or reviewer looks for.
  2. CSP present, but with unsafe-inline and unsafe-eval for scripts, which removes most of what CSP is for.
  3. No HSTS, so the first visit over plain http isn't forced to https.
  4. No Referrer-Policy or X-Content-Type-Options. These are one-line headers, and most hosting platforms let you set them in a config file.

Also worth a look (not from this batch)

A few other checks cost nothing: an Open Graph image so shared links get a preview, a real page title instead of the framework default, www and the bare domain both resolving, and a real favicon.

What to take from it

The items that cost the most (1-4) take a minute to catch and aren't about security at all. They're about whether the thing you're pointing people at actually loads for a stranger. Before posting, open your launch link in a private window on your phone, and paste it into a Slack DM to yourself to see the preview.

If you want this as a checklist that runs in your browser, the free 12-check version is here: https://launch-gate-demo.smagnezi8.workers.dev

Launch Gate only runs passive checks. It is not a security audit or a penetration test.

Top comments (0)