ShieldStack Goes Live: Fixing False Positives & Deploying to the World

Had a productive session getting ShieldStack ready for prime time today. This security scanning platform for vibe coders was sitting on my local machine gathering dust, so it was time to push it out into the world.

Getting My Deployment House in Order

First reality check: I had no GitHub repo, no deployment config, nothing. Classic developer move - build cool stuff, forget to share it. So I created the cwinvestments/shieldstack repo and pushed everything to master. Yeah, master not main - that's just how the repo initialized and I'm rolling with it.

Added proper Netlify deployment config with Next.js SSR support. The plan is to eventually grab shieldstack.dev or shieldstack.pro as the final domain, but for now it'll live at shieldstack.netlify.app.

Fixing Annoying UX Issues

You know what's frustrating? When you type "google.com" into a URL field and it yells at you because there's no protocol. Fixed that by switching the input type from "url" to "text" and adding smart normalization - if you don't include https://, we'll add it for you. Both client and server side now handle this the same way.

The Big Fix: SSL False Positives

This was the meaty problem. The SSL checker was throwing critical errors for everything - sites that were perfectly fine but just required auth, unreachable domains, you name it. Not helpful when you're trying to actually identify real security issues.

I rewrote the error handling to be way smarter:

• Actual certificate problems (expired certs, self-signed, etc.) → Critical severity
• 401/403 responses → Info level (SSL is fine, just needs auth)
• Connection timeouts/DNS issues → Info level (not an SSL problem)
• Everything else → Info level (better safe than sorry)

The trick was digging into Node's fetch error chain to extract the actual error codes. Now when something gets flagged as critical, you know it's actually worth fixing.

What's Next

Code is pushed, deployment config is ready. Next step is connecting this to Netlify and setting up the environment variables. Then we'll see how it performs in the wild with real security scans.

The false positive fix alone makes this way more usable. Nothing worse than a security tool that cries wolf constantly.