LaunchTrust is a passive public-surface scanner for security-aware app developers, vibecoders and ecommerce
operators. It looks for exposed frontend secrets, open .env/.git paths, SPF/DMARC
and security headers, then layers in AI notices, privacy pages, refunds, accessibility, app-store signals
and signed evidence records.
Compliance aid, not legal advice. Paid checkout stays paused until the dashboard is live.
The first pass looks at what anyone can already fetch: JavaScript bundles, source-map references, public files, DNS email-auth records and HTTP response headers. It helps catch accidental exposure before a buyer, reviewer or attacker sees it.
LaunchTrust flags risky public patterns for OpenAI, Anthropic, Stripe live, AWS, Google, GitHub and private-key material. Findings stay framed as review signals with evidence, because false positives are possible in static pattern scans.
The public-surface pass also checks reachable .env and .git paths, CSP, frame
protections, MIME-sniffing defense, referrer policy, HTTPS/HSTS, security.txt, SPF and DMARC.
Passive public-surface checks only. No intrusive testing, private crawling or credentialed access.
LaunchTrust does not replace counsel or platform review. It turns visible launch risks into a practical, source-backed checklist before you submit an app update, publish a landing page, or open an ecommerce checkout.
Checks whether an AI chatbot, assistant, companion or copilot is clearly disclosed at the right moment.
Looks for privacy-policy access, deletion paths and clause coverage for data handling claims.
Flags visible consent language, common tracking scripts and cases where controls do not match trackers.
Reviews refund, return, cancellation and withdrawal surfaces for stores and paid SaaS flows.
Runs basic checks for language, title, image alt text, form labels and zoom behavior.
Looks for public frontend leaks and security headers using passive public-surface checks.
.env/.git, CSP, HSTS, mixed content, security.txt, SPF and DMARC.Looks at public App Store and Play surfaces for privacy links, data-safety cues and listing alignment.
Pro will preserve a dated record of what LaunchTrust saw, signed for later verification.
LaunchTrust Pro is planned as a set-and-watch layer for public launch surfaces. It focuses on passive scans: public pages, headers, store listings, DNS email-auth records, policy links and visible JavaScript bundles. Deeper testing would require separate ownership and authorization controls.
Flag risky patterns such as API keys, private-key blocks, open .env files, exposed .git paths and missing email-auth records before customers or reviewers find them.
Planned alerts notify by email, Slack or CI webhook when a signed scan changes: policy text disappears, a header regresses, a tracker appears, or a store listing no longer matches the site.
The upcoming /api/jurisdictions registry maps 39 countries across 8 categories so a founder can choose markets and see the relevant public-surface checks.
The first free module is still AI Notice Kit. Answer four questions to see whether your app likely needs a visible AI notice, then copy the no-tracking badge snippet.
LaunchTrust Pro will add the broader signed scan when the paid dashboard opens.
1. Does your product have an AI chatbot, assistant, companion or copilot that talks to users?
2. Where do users interact with it?
3. Can people in the EU use it?
4. Any users in the US?
LaunchTrust is strongest when it can show exactly what was visible at scan time. The Pro record is designed around 27 detectors, 35 sourced rules, selected markets and an ECDSA-signed canonical evidence log.
{"signed_at":"2026-06-18","version":"v1"}
Verify a signed record
The free badge stays available. It runs in the visitor's browser, sends us nothing about your users and gives you a clear notice for AI chat, companion, copilot and assistant surfaces.
<script src="https://launchtrust.co/disclose.js"
data-disclose data-lang="auto"></script>Primary endpoint for the free AI Notice Kit module.
Free AI disclosure remains open. Pro and Studio stay paused until LaunchTrust dashboard, entitlement and signed-record flows are fully deployed. After subscribing, customers sign in at app.launchtrust.co.
$0
$19/mo
or $190/yr
$49/mo
or $490/yr
LaunchTrust keeps the public copy plain: each row is a check surface, not a legal conclusion. The backend registry is designed around 39 jurisdictions and 8 categories.
No. LaunchTrust is a compliance aid that helps you find visible public-surface gaps and keep evidence. It is not legal advice or certification.
AI disclosure is still a strong wedge and a real free utility. LaunchTrust is the parent platform; AI Notice Kit is the disclosure module inside it.
No. The free badge runs in the browser and does not send us page views, user identifiers, prompts, conversations or device data.
No. The product is designed around public launch surfaces and public store pages. Do not submit credentials, unpublished pages or private customer data.
No. LaunchTrust focuses on passive public checks: visible bundles, public headers, DNS records and exposed files. Deeper testing would require explicit ownership and authorization controls.
Yes. The expanded scanner includes refund, return and cancellation surfaces, especially for online stores and paid SaaS checkout flows.
Start with the free AI notice, then move to passive secret checks, market-aware scans and signed monitoring when Pro reopens.