Securealy
Check · Launch hygiene · low · passive

No builder leftovers

No dev-server hints, placeholder copy, builder badges or chat residue in the HTML.

Severity
low
Tier
Passive: runs on any URL
Category
Launch hygiene
Fix
Summary below; full runbook in the Fix Kit, Module 01: Ship it
Id
ai-leftovers

What this means

Passing means the HTML of your home page carries nothing from the build process: no dev-server hints, no placeholder copy such as lorem ipsum, no builder badge, no chat residue in comments. Failing means at least one of those is in the page a visitor receives. These are the fingerprints of a site that was generated and shipped without a read-through.

How we test it

We fetch the home page and read the HTML as a visitor's browser would, including the comments. We look for development-server markers, placeholder text, badges or links inserted by a builder tool, and conversational text in comments that reads like an assistant talking to its user. One finding warns. Several findings, or placeholder copy in visible text, fail. We do not read your source, only the served page.

Why it matters

Leftovers tell visitors and attackers the site was never reviewed. A visitor who sees lorem ipsum under a pricing heading stops trusting the price; an attacker who sees a dev-server hint knows which stack and which habits to expect. The kit holds every page to the gates a professional launch is held to, and a read of the served HTML is the cheapest of them.

The fix

Read the served HTML of the home page end to end, remove every placeholder string, builder badge, dev-only script tag and chat-style comment from the source file it came from, and rebuild so the deployed output changes. Confirm with curl -s https://YOUR_DOMAIN/ | grep -ciE 'lorem ipsum' (expected 0) and a read of curl -s https://YOUR_DOMAIN/ | grep -oE '<.--.*-->' showing nothing conversational. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -s https://YOUR_DOMAIN/ > /tmp/home.html and tell me the file size.
Run: grep -ciE 'lorem ipsum|placeholder|TODO|FIXME' /tmp/home.html and show me the number, then show me each matching line.
Run: grep -oE '<.--.*-->' /tmp/home.html and show me every HTML comment.
Run: grep -iE 'localhost|127\.0\.0\.1|:3000|hot.?reload|dev.?server' /tmp/home.html and show me any match.
Tell me which source file each finding comes from, and whether it is visible to a visitor or only in the markup.
List what it would take to remove each one, and stop there.
Run: grep -ciE 'lorem ipsum' /tmp/home.html and show me the output. Expected on a passing site: 0.

Next

Grade your own URL

Every grade lists this check with its evidence for your site. Two free grades a day.