Toolchestrator: the runtime for vibe-coded apps

Failing · 8

• CompressionNo compression: pages ship larger than they need to
• HSTSVerify that you own this domain to see this finding.
• Content-Security-PolicyVerify that you own this domain to see this finding.
• MIME-sniff guardVerify that you own this domain to see this finding.
• Clickjacking guardVerify that you own this domain to see this finding.
• Structured dataNo structured data: rich results and AI parsing are harder
• Organization schemaNo JSON-LD to hold an Organization/Product type
• Social presenceNo social profiles linked: visitors can't follow or vouch for you

Partial · 13

• HTTPS enforcedHTTPS works, but http:// isn't redirected
• Modern HTTPHTTP/2+ not advertised (or hidden by the CDN)
• Asset cachingValidators present, but no explicit Cache-Control
• Referrer-PolicyVerify that you own this domain to see this finding.
• Permissions-PolicyVerify that you own this domain to see this finding.
• security.txtVerify that you own this domain to see this finding.
• Supabase row-level security (data exposure)Verify that you own this domain to see this finding.
• AnalyticsNo analytics in the HTML — if it loads as a module, only a browser audit can see it
• Description lengthDescription is 269 chars (aim 70–160)
• Apple touch iconNo apple-touch-icon: ugly when saved to a phone home screen
• Web app manifestNo web app manifest: not installable as a PWA
• Theme colorNo theme-color: the mobile browser chrome stays default
• TermsNo terms of service linked