Your app calls routes that cost money per request
Your client-side JavaScript names backend routes or serverless functions that spend money every time they run (the value).
Why it matters
Your client-side JavaScript names backend routes or serverless functions that spend money every time they run (the value). This scan did NOT call any of them — doing so would spend your model, email or SMS budget — so it makes no claim about whether they are protected, and this is not a finding that something is wrong. It is the list to check: an endpoint like these reachable without a login is a public, billable API, and one without a per-user rate limit lets a single abuser run up the bill (a cost-based denial of service). Confirm each one requires authentication BEFORE it calls the paid provider, enforces a per-user rate limit, and sits under a spend cap with a billing alert.
How UseShipReady detects it
Cost-bearing routes and serverless functions the site's own JavaScript names: model calls, email and SMS senders, image and audio generation. Reads the bundle text the scan has already fetched and issues NO request of its own — not to the site, and never to a discovered surface.
Detection is deterministic. UseShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt UseShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
UseShipReady found backend routes or serverless functions named in your client-side JavaScript that cost money every time they run (routes or serverless functions that cost money per call). It did NOT call them — that would spend your model, email or SMS budget — so this is a checklist, not a confirmed problem. For each one: authenticate the caller BEFORE the paid provider is called, so an unauthenticated request costs you nothing; add a per-user rate limit and a global one, because a single abuser looping a model or SMS route is a cost-based denial of service; validate and bound the input size (a 100,000-token prompt costs 100,000 tokens); and set a hard spend cap plus a billing alert with your provider, which is the only control that works while you are asleep. Treat any of these reachable without a login as a public, billable API.
Frequently asked questions
- What does "Your app calls routes that cost money per request" mean?
- Your client-side JavaScript names backend routes or serverless functions that spend money every time they run (the value).
- How serious is it?
- UseShipReady rates this info. Informational. No action strictly required.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt UseShipReady puts in your report.
- Can I check my own site?
- Yes — UseShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
UseShipReady checks this and 196 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.