Home PocketSec
PocketSec
Scorecard
56/ 100
Stage: Alpha on our own rubric. Google Play: No Android app.
Primary journey: shown with sample data
Scored 2026-11-08 on our own rubric; repository at commit af82be6.
What we promised, and what we have not finished. We promised one public rubric for every product, a list of what is not finished on every page, and a named source for every number. Most of these products are not finished, and each page says where it stops. Read the rubric or every claim and its source.
Recorded 2026-11-08 on the demo profile. The scorecard in the video shows 63; the site shows 56/100 on our own rubric (2026-11-08). The device check on a real device, the breach lookup and the PDF report were not run. The AUTO-5 menu wording is not confirmed on a real Chrome for Android or Android 16. Re-recorded 2026-11-08 against pocketsec main af82be6; shows #88 AUTO-5 menu wording and #65 shorter habit summaries on the demo profile; the unmeasured 'sixty seconds' narration is now attributed to the button label; the changelog gap line is removed. Captions aligned and checked (worst cue 0.05 s); frame scan no hits. Re-encoded 2026-11-08. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.
This button opens your email app with the subject already filled in. Your message comes to support@shipitworks.com. There is no form and no database. Privacy notice.
Works today
Each line links to the scorecard row that backs it.
Not finished
From the same scorecard, next to the claims.
- The web device check (AUTO-1..5), the habits audit (HAB-1..6), the password check and the PDF report have no test or proof log on the main branch; the web test suite and browser run of 2026-11-01 are on a branch that is not merged
- Shield Score, the build and the live site are each half credit: a recorded run exists, but no proof log for them is on main
- What leaves the device is not yet traced: no network capture is on main; the README on main says a no-transmission claim for the password and the page says '60-Second Security Scan' (not measured)
- AUTO-5 menu-path wording changed (#88), but its check script does not pass on Android and no log is committed
- No TWA or AAB; assetlinks.json still holds REPLACE_WITH_ placeholders; the Play 12x14 closed-test rule applies
- LICENSE.md is PolyForm Noncommercial while the plan says All rights reserved - mismatch unresolved
- No CSP header; no privacy page on main; contrast, keyboard and TalkBack not checked; dark theme is fixed with no light mode
- Native fix-text Settings paths: 4 of 5 found on a stock Android 36 emulator, 1 not found (Software update), exit 1 (proof/native-fix-paths.log, 2026-11-08T06:14:48Z); not a phone
- CHANGELOG.md on main still says there are no release tags (tags v0.1.0 to v0.5.0 exist); package.json says 0.1.0
- Web code has no test script in package.json; the only test run on main is the 43 native engine tests, on a Linux JVM, not a phone
What changed
Dated lines from the scorecard. The source code is private, so these lines are the public record.
- 2026-11-08: Native password-check copy now names the host it contacts (api.pwnedpasswords.com) and says the check shows your IP address to Have I Been Pwned; 4 source-reading tests added, 43 native tests pass on a JVM (#44). A run recorded that the habit-fix third-party phrases match six vendor pages, 6 of 6 (#43). A run on a stock Android 36 emulator found 4 of 5 native Settings paths; one not found, run exited 1 (#51). Release v0.5.0.
- 2026-11-08: Two sentences no source backs were dropped from the habit summaries and the web password text, web and native (#62). Release v0.5.0.
- 2026-11-08: Notes only: FOUND.md and LEARNINGS.md additions (#40). No app change.
- 2026-11-08: Menu paths in the device-check fix steps now match the screens on Chrome for Android and Android 16, and a script to check them was added (#88). The script's Android step does not pass yet and no log is committed. Release v0.4.0.
- 2026-11-08: Three long sentences in the habits summaries were split, web and native; punctuation only (#65). Release v0.4.0.
- 2026-11-08: CI now runs on the self-hosted runner (#96); the CI run at 698dc92 passed lint and build (run 42482618888). Release v0.4.0.
- 2026-11-07: The 39 native Android engine unit tests pass on a Linux JVM (logged; not run on a phone). The native README credits ShipItWorks and the public support address, a CHANGELOG was added, and the CI actions are pinned to commit SHAs. Release v0.3.0.
The next step for PocketSec.
Email us about PocketSec