Placeholder — have a lawyer review this before launch

Not a pentest. No guarantee.

A LockShip scan is a point-in-time, best-effort, read-only review of a public URL. It is not a penetration test, a security audit, or a promise that an app is safe to launch.

The Launch Safe badge means only that a later re-scan found no critical or high findings in the checks LockShip knows how to run. It can miss vulnerabilities. It can also flag something that is safe in your context. A weekly monitor, if you buy one, expires or greys the badge when a later scan fails. It does not watch the app between scans.

You must control the domain you submit. LockShip refuses to run the scanner until a DNS TXT record, a meta tag, or a /.well-known/lockship.txt file proves that. Probes are GET and HEAD only. Database checks request at most one row and redact it. That is still enough to reveal that data was exposed, so do not scan a site you do not own.

LockShip and its operator are not liable for a launch decision you make from a report. Fix the findings, re-scan, and get a human to look before you handle real customer data.