Your live site’s HTTPS and headers, graded every day.
Verify your app’s domain once. Every day, PatchLabs loads your public home page the way any visitor’s browser does and grades HTTPS, the certificate, the security headers, cookie flags and mixed content, then tells your team when the grade drops.
demo-app.patchlabs-demo.example
Verified · checked 3 hours ago · next check in 21 hours
- medium
PL-030No Content-Security-Policy - medium
PL-033Session cookie without HttpOnly - low
PL-032No X-Content-Type-Options: nosniff
- Scheduled · grade C · 65today
- Scheduled · grade B · 80yesterday
- Verified · grade B · 809 days ago
What we read
One ordinary page load. Nothing else.
A passive check, like Mozilla Observatory or securityheaders.com: it reads what your site already sends to everyone who visits.
Three things, once
- One plain
http://request to your home page, to see whether it redirects to HTTPS - One
https://load of your home page, following at most 5 redirects - The TLS handshake of that load, to read the certificate
From the response it reads the status, the security headers, the Set-Cookie flags (cookie names, never values) and the script and stylesheet addresses in the page’s HTML.
No probing, no payloads
- Touch your database, or test your app for data leaks or vulnerabilities
- Request other paths, guess URLs or follow links
- Submit forms, call your API or sign in
- Check a domain your team hasn’t verified
The free headers check makes the same single page load for any public address, and stores nothing.
Verify
Prove the domain is yours, one of two ways.
Each app gets its own live code, separate from the repo code you committed to start monitoring. Publish it either way, press Verify, and the first check runs at once.
A file at your site’s root
A file named patchlabs-verify.txt whose whole content is the code. In a Vite or Lovable project, put it in public/.
patchlabs-live-3f9c2a17d04be6a1Or a meta tag on your home page
Inside <head> of the page your domain serves at /. Handy when you can’t add files.
<meta name="patchlabs-verify" content="patchlabs-live-3f9c2a17d04be6a1">Example code: your app shows its own. Redirects must stay on the same host (or its www twin), so another site can’t vouch for yours. You can remove the file or tag after verifying.
The grade
A to F, from ten checks with stable IDs.
Start at 100. A failed high check costs 30, a medium 15, a low 5; information findings are free. Each check costs its points once, however many cookies it caught. A is 90 or more, B 75, C 60, D 40, anything lower F.
An invalid or expired certificate is always F, because visitors get a full-page browser warning. Sites on HSTS-preloaded top-level domains such as .app and .dev pass the HTTPS redirect and HSTS checks without doing anything, since browsers never load them over plain HTTP.
| ID | Check | Severity |
|---|---|---|
| PL-027 | Site doesn’t force HTTPS | medium |
| PL-028 | Certificate invalid, expired or expiring within 21 days | high medium |
| PL-029 | No HSTS, or max-age under 180 days | low |
| PL-030 | No Content-Security-Policy | medium |
| PL-031 | Any site can frame the page | low |
| PL-032 | No X-Content-Type-Options: nosniff | low |
| PL-033 | Cookie without Secure, or session cookie without HttpOnly | medium |
| PL-034 | Scripts or styles over plain HTTP | medium |
| PL-035 | Server headers reveal software versions | info |
| PL-036 | No Referrer-Policy | info |
How it works
Verify, check daily, alert, share.
Verify
Set your app’s domain in the app and publish the file or meta tag. The first check runs as soon as it’s found.
patchlabs-verify.txt verified · grade BCheck daily
A fresh check every day while the app’s re-checks are on, and “Re-check now” whenever you ship a change.
next check in 24 h re-check nowAlert
An email to your team and a
posture.changedevent to your workspace webhook, only when the grade drops or a finding appears.B → C · 1 new finding PL-030 no CSPShare
An opt-in badge with the grade and the date of the last check, for your README or footer.
live posture · A 10 Nov 2026
Badge
Show the grade, dated.
The live badge shows your latest grade and the day it was checked. It reads “private” until the app’s badge is public and the domain is verified.
A badge is not a certification. It reports our last check of the headers and settings your home page sends.
[](https://patchlabs.dev/proof?app=<app-id>)Why it matters
AI builders get the app working, not the headers.
Generated projects ship with whatever the host sends by default, and that rarely includes a Content-Security-Policy, framing rules or nosniff. The fixes are a few lines in vercel.json, _headers or a Cloudflare rule, and every finding page has them.
What Live posture can’t see. It reads one public page, so it says nothing about who can read your database, what your code does or whether your keys are exposed. Those are the leaks that matter most in AI-built apps, and the Lab and Code checks cover them from your repo. Live posture isn’t a vulnerability scan, a penetration test or uptime monitoring.
Does Live posture touch my database or my users’ data?
No. PatchLabs never touches your database. Live posture only loads your public home page, like any visitor, and only on domains you verify. It never signs in, so it sees what a logged-out visitor sees.
How often does it check?
Once a day while the app’s re-checks are on, plus whenever someone presses “Re-check now” (at most once every 10 minutes). Turning the app’s schedule off pauses the daily check too.
Who gets alerted?
Everyone who gets the app’s alert emails, and the workspace webhook as a posture.changed event (with a short message for Slack, Discord and Teams). Only when the grade drops or a new finding appears, never for an unchanged result.
Can I change or remove the domain?
Yes. An owner or admin can change it (it needs verifying again) or remove it, which deletes its check history. Your site isn’t touched either way.
Do I need a paid plan?
Live posture is part of Watch, which every plan includes. Start with the free headers check, no account needed.
Free headers check
See your grade now, no sign-up.
Type your site’s address. You get the grade, every finding with the fix for your host, and what we saw. Sign up to have it checked every day.