Supported marker identifies the deployment as associated with a recognised AI builder
ShipReady found a supported artifact or runtime marker associated with a recognised AI builder in the inspected deployment evidence.
Why it matters
A public builder association can be useful deployment and reconnaissance context when reviewing what the site intentionally reveals about its tooling.
How ShipReady detects it
What it inspects
ShipReady first reuses confirmed public AI-tooling artifact paths from its bounded origin probe. A confirmed supported artifact path can identify the associated builder.
When no supported artifact identifies a builder, ShipReady searches fetched page and script content plus the final URL for a fixed set of supported Lovable or Replit runtime markers.
What triggers a finding
The rule triggers when a supported artifact or runtime marker identifies one recognised builder. Confirmed artifact evidence takes precedence over runtime-marker evidence, and the rule emits at most one site-level finding.
What the evidence shows
A supported marker associated with the reported builder appeared in the deployment evidence inspected by ShipReady.
Limits of this check
ShipReady does not infer a builder from generic framework output, prove who authored the application, or establish a vulnerability, insecure configuration, exposed credential, or general security problem with the reported builder. The marker is deployment and reconnaissance context only.
How to fix it
Confirm the intended public marker
Identify the reported artifact or runtime marker and decide whether it is intentionally part of the deployed application.
Remove unintended deployment artifacts
If the marker comes from a repository artifact that should not be public, adjust deployment output and static-file rules to stop serving it.
Review actual configuration findings separately
Use evidence-based security findings to review configuration and credential risks rather than treating the builder association itself as a security defect.
How to verify the change
Inspect the deployed public output
Request the reported artifact path or inspect the delivered page and scripts for the marker after deployment.
Expected: Public deployment markers match the product's intended disclosure of its tooling.