LaunchProof
Automated Website Launch Readiness & Verification Platform
LaunchProof is a production-focused web platform that solves the release readiness dilemma for web teams. It runs 17 automated checks across availability, security headers, indexing metadata, and mobile viewports, synthesizing a definitive READY / NOT READY launch verdict and numerical Launch Score.
Project Snapshot
The Silent Launch Defect Dilemma
Security Header Omissions
Web apps frequently ship with HTTPS enabled but omit HTTP Strict Transport Security (HSTS), Content-Security-Policy (CSP), and X-Frame-Options, exposing users to clickjacking and SSL downgrade attacks.
Broken SEO & Social Previews
Missing canonical tags create duplicate content penalties in search engine indexes. Unconfigured OpenGraph tags cause broken preview cards on LinkedIn, Twitter, and Slack, degrading launch credibility.
Subjective Manual Checklists
Engineering teams rely on manual QA spreadsheets that are inconsistently followed before deployments. LaunchProof replaces checklists with an automated, reproducible scan returning an authoritative Launch Score.
Implementation State & Project Boundaries
- •17 automated readiness checks across 4 operational categories
- •Weighted Launch Score algorithm (0–100) with duplicate precedence
- •Verdict generator classifying release blockers vs warnings
- •Public report share URLs with server-only privileged Supabase tokens
- •HMAC-SHA256 anonymous IP rate limiting (zero plain IP storage)
- •Multi-page recursive crawler with depth limiting
- •Historical scan comparison diffs across release iterations
- •Dynamic redirect chain latency tracing
- •GitHub Actions CI/CD bot for pull request merge blocking
- •Core Web Vitals synthetic field budget audit
- •Automated weekly regression cron monitoring
End-to-End Scan Pipeline & Data Flow
Client UI Layer
Next.js 16 (App Router) + React 19 + Tailwind CSS
Captures target URL, validates syntax client-side, and renders real-time scan progress, category status accordions, and Launch Score gauges.
API & Security Boundary
Route Handlers + HMAC IP Hashing + SSRF Filter
Enforces anonymous rate-limiting via HMAC-SHA256 fingerprinting (zero raw IP persistence). Blocks internal intranet IPs (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
Inspection & Crawl Engine
lib/scans/crawler.ts + http-client.ts
Dispatches resilient HTTP client requests with strict timeouts (10s), tracks redirect hops, parses raw HTML DOM headers, and runs 17 structured checks.
Launch Score & Verdict Policy
lib/launch-score/calculate-launch-score.ts + v0-verdict.ts
Computes a 0–100 score by summing earned points over scorable max points with duplicate check precedence (fail > warning > pass). Returns READY / NOT READY verdict.
Persistence & Share Layer
Supabase PostgreSQL + Row Level Security (RLS)
Stores scans, check evidence, and public report share tokens. Employs server-only SUPABASE_SECRET_KEY for privileged report management.
Evaluated Check Matrix (17 Rules)
Confirms domain reachability, HTTP 200 response codes, and latency budgets under 1,000ms.
Audits HTTPS transport enforcement and critical HTTP security defense headers.
Evaluates document metadata required for indexing, link previews, and responsive viewports.
Verifies crawler directive access rules and XML sitemap discoverability.
Design Trade-Offs & Security Boundaries
Server-Only Privileged Security Boundaries
The Supabase Service Role Key (SUPABASE_SECRET_KEY) is strictly quarantined within server-only route handlers and Server Actions. Browser bundles interact exclusively through unprivileged client clients governed by PostgreSQL Row-Level Security (RLS), preventing unauthorized write access to public report shares.
Privacy-First HMAC Rate Limiting
To prevent denial-of-service abuse while upholding user privacy, anonymous scan quotas are enforced using an HMAC-SHA256 hash of the client IP and User-Agent salted with ANONYMOUS_SCAN_HASH_SECRET. Raw IP addresses are never written to database tables or logs.
SSRF Defense & URL Policy Enforcement
Before any outgoing HTTP scan request is dispatched, the URL is resolved against a strict policy engine (url-policy.ts). Requests to private IP spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, loopbacks, and cloud metadata endpoints) are immediately rejected to prevent Server-Side Request Forgery.
Policy-Driven Deterministic Scoring
Rather than arbitrary heuristic scores, LaunchProof calculates scores through explicit point contracts (calculate-launch-score.ts). Duplicate checks follow strict precedence (fail > warning > pass > skipped), guaranteeing identical scan inputs always produce mathematically identical scores.
Verified Test Scenarios & Repository Artifacts
Verifies weighted point summation, exclusion of skipped checks from scorable maximums, and status precedence resolution when multiple scans report conflicting results.
test("calculates score with duplicate key precedence", () => {
const results = [
{ key: "security.https", status: "pass" },
{ key: "security.https", status: "fail" } // Should take precedence
];
const score = calculateLaunchScore(results);
assert.equal(score.earnedPoints, 0);
});Validates protocol sanitization, normalization of target hostnames, and rejection of malicious loopback, private intranet, or IPv6-mapped localhost URLs.
test("rejects private intranet addresses to prevent SSRF", () => {
assert.throws(() => validateScanUrl("http://169.254.169.254/latest/meta-data"));
assert.throws(() => validateScanUrl("http://127.0.0.1:8080/admin"));
assert.ok(validateScanUrl("https://erbdinesh.com").isValid);
});Explicit Engineering Boundaries
1. Target Scope Boundary: LaunchProof v0.4 focuses on single target URLs (typically the landing page or marketing entry point) rather than full-domain crawls. This keeps execution times under standard 10-second serverless HTTP execution budgets and prevents unbounded crawler resource consumption.
2. Static HTML vs Heavy Client SPA: Checks evaluate the raw HTTP response and initial DOM. Websites that render critical SEO meta tags exclusively via client-side JavaScript hydration (without SSR or static export) may require headless browser execution, which is planned for a future worker tier.
3. No Fabricated Performance Claims: We publish zero unverified customer adoption metrics, simulated speedup claims, or fictitious enterprise logos. All capabilities documented here reflect actual source code residing in the LaunchProof repository.
Explore More Engineering Work
Return to the main portfolio to review verified production iOS case studies (BNL, Insomnia Cookies, Mighty Audio) or explore the Interactive AI Engineering Lab.