CanIShip

Trigger warning : this post WILL be pitching a product. it is both self-serving as well as serving you.

I've been doing the thing I probably should have warned you I was going to do. I've been running audits on products people post here. A lot of them (28 so far).

Folks, some of you are shipping things that should not be shipping. I know I know, these are mostly MVPs, but to hear you in your posts you sound so happy with it. and some of you really have nailed it (especciallly those with teams, and Dev-ops backgrounds, or engineering - your sites and products are really awesome and I sincerely wish I could get my products there) But I'm delusional, I know the limitations. For the rest you, I mean... you have missing security headers, exposed data surface, no HTTPS enforcement, Content-Security-Policy not configured, X-Frame-Options missing, the kind of stuff that makes an ISMS auditor physically uncomfortable. I spent the past few years doing information security consulting and keeping myself up to date (and that's not even my original career - I just fell in love with cybersecurity waaaay too late in my life).

I want to be clear: I'm not here to shame anyone. I'm exactly... well, almost exactly like some of you. Maybe around 75%.. "wow I can build a thing in my head", alone - with no 8-person full-stack team. It can be done over a couple of days (terrible statistic by the way; so many shit products), you're trying to get to market before you run out of motivation.. so, security headers are not the thing that keeps you up at night. I get it. But they should at least be on your list. (I don't mean to just harp on about security, there's many other things as well).

Here's roughly what I've seen across the audits I've run: like I said earlier, products above 90/100 are almost all built by engineers with teams. Products 75 and below are almost all solo builders. (in between is likely solo builders who probably spent loads of time on quality - well done you!) To be clear, the gap is not "intelligence" or "effort" (even though I just said that, but I mean in general). It's just that engineers have the muscle memory for this stuff and the rest of us don't.

(now the plug, but seriously, it'll help you) CanIShip has come a long way since I posted. The tool audited itself at 75/100 when I first launched. It's at 96 now (I fixed what it found on itself, which felt right). The reports are more detailed, the scoring is more calibrated, and I am still working on the Docker self-hosted option which I think will be great for those of us who can't send our app URLs to a third party service. That last one is in alpha, I'm not happy with it at the moment because I think it needs to be more feature rich.

If you've shipped something and haven't run a real QA pass on it, go do it. Use CanIShip, use something else, use a checklist, use whatever. Just run the check. In my ops world, a product that's live (and in your case collecting real users info and hopefully money) deserves to at least have the same quality gate you'd apply to anything physical before it leaves the warehouse. Otherwise you are just the Temu product quality of the app world, and once your credibility is hit, you can forget about future products doing well.

I built this for me. But like i said above, "I'm exactly... well, almost exactly like some of you. Maybe around 75% ":). So I figured, you also need help like me. It's at caniship.actvli.com. The free audit covers enough to tell you whether you have a problem. The builder version is where I tested most of you nd you landed at betwee 55-75. The studio version I used to test the products made by the engineers. (when I used studio on some of you.. well, it prompted me to write this (below 40 with a big "do not ship").

And if you're one of the products I audited that scored well, genuinely, good work. You care about the craft and it shows.

I'm not a developer (I want to say that upfront because everything that follows makes a lot more sense with that context.)

If you check out my LinkedIn, you'll see my career has been operations, supply chain, project management and ISMS. 7 years at Nokia (before the fall) managing global demand networks . A food truck-turned-take-out-turned events business in South Africa. HMD Global as Head of New Business Services. A string of consulting engagements via my company Äctvli taking care of post-M&A integration, process optimisation, ESG, PMO leading 12 concurrent integration projects simultaneously. information security. I finished an MBA in 2024. All the stuff we're told to say on LinkedIn to inflate ourselves (like anyone nowadays really gives a sh*t; all they want is your business - come on, you are all doing that here as well ;) )

All this is to say that I have never, in my life, written a line of production code. And somewhere in the mid 2010s I thought I should have learned to. But in June 2025 I built an AI PC. Helloooo agents... and tools. God bless all you AI engineering geniuses. You took a thing, and made it so non-techies like myself can unleash the ideas in our heads.

I started experimenting with Ollama, WebUI, n8n, etc.. massive shout out to NetworkChuck for teaching me. I'd already been using AI since around 2021; ChatGPT. and I hated that I didn't own my prompts and questions. In my ISM world, and my client's data, I refused to use anything online. Hence the offline AI PC. from there I learned about Claude on terminal. Then i started building with it. Then I couldn't stop. It's crazy.

I built tool after tool for my own use. an Email Sanitizer through Python t hat redacts any and all sensitive information (addresses, names, phone numbers, products - gives them random codenames etc.. so I can add to my knowledge base and then use it to help with preparing reports or tasks). An exel formula tool - just describe what you want and voila.. ISO, DORA, PMP templates to support my PMO and certification for clients seeking those. Those are just for my internal use. then I realized others might need some tools I use for myself. So "I" built 9 SaaS products. It sounds like either a lie or a disaster but it's neither, it's just what I've always done: define the problem, design the process, iterate fast, measure what matters.

I'm not claiming any of these are perfect... and THAT taught me something and was the antithesis of CanIShip. (did I use that word correctly?) The idea came from a problem I kept hitting personally. I'd finish building something and have no reliable way to know if it was actually ready to ship. It bothered me a lot because in any physical production you don't ship a product without a quality gate. And before AI assisted ccoding tools (I REFUSE to call it "vibe coding" which is about as hacky as "growth hacking") software was no different.

So I built the quality gate. AND IT FRIGGING WORKS! Here, I'll let Claude explain:

CanIShip runs eight automated audit layers on any web app URL and returns a ShipScore:

• Playwright functional tests (navigation, broken interactions)

• UX issue detection (dead ends, missing states)

• WCAG 2.1 AA accessibility via axe-core

• Lighthouse performance and Core Web Vitals

• OWASP security headers scan

• Broken links and network failures

• SEO health (title, meta, Open Graph, sitemap, robots.txt)

• Mobile readiness at 375px — viewport meta, horizontal scroll, touch target sizes

The whole thing runs in minutes and produces a report with specific findings, severity ratings, and fix recommendations. The ShipScore is 0–100 with a Ship It / Don't Ship / Conditional verdict.

Than you Claude, Ok, I'm back now. I then audited my own tool with my own tool, HA! It scored 75/100 initially which is a non-shipping quality. I've since fixed most of the issues it found on itself and it's now at 96/100! That felt like a very appropriate way to test it. I've tested on a lot y'alls apps, and some of you have the >90 score, but a lot of you are below the 60s. the most common denominator of success is the one above 90 all are engineers, and have teams. this tool is not for you. It is for everyone else; morons like me.

Yup. I built this for solo builders like me — people shipping fast without a QA team. And I need to reach them. My consulting background means my LinkedIn network is enterprise people who don't need this.

I am currently working on providing a Docker self-host license. I have no idea if that's right. The eight layers cover a lot, but I know they don't cover auth-gated flows, load testing, or real manual QA. I'm honest about that in the product.

I'm posting this partly because someone told me the imposter syndrome I feel doesn't go away by waiting until you feel ready. So here it is. Built by an operations guy from Argentina, living in Finland, who build an AI PC

The tool is at caniship.actvli.com