Vibecode Rescue: shazpay.link

ShazPay sells payment links with installment plans — a freelancer or agency creates a link, the client pays in full or across milestones, and the money lands in a couple of days. The feature has a name, FlexiFund, and the pricing is legible: free, $29 a month, $79 a month, with transaction fees stepping down from 3.9% + $0.45 to 3.3% + $0.35.

It scored 48 out of 100. At Risk.

Observed on 2026-08-05 against a snapshot of the page, the shipped bundle, response headers, DNS and the legal and security pages. Signup was not completed.

The security page claims four certifications

The /security page is unambiguous. Verbatim:

SOC 2 Type II Compliant — Independently audited security controls and procedures that meet the highest industry standards for data protection.

PCI DSS Level 1 — Highest level of payment card industry compliance

ISO 27001 — International standard for information security management

GDPR Compliant — Full compliance with European data protection regulations

Alongside those: a 99.9% uptime SLA, AES-256 at rest "with regularly rotated keys", TLS 1.3 in transit, 24/7 monitoring, and MFA including hardware keys.

No auditor is named. No report is offered, not even gated behind a form. A trust centre, a certificate number, an audit period or a report date would each settle it; the page carries none of them. Four certifications, zero artifacts.

I cannot prove from outside that a SOC 2 Type II report doesn't exist — that's exactly the kind of claim a black-box pass can't settle, and I'm not going to pretend otherwise. What I can say is that every one of those claims is checkable by the company in about a minute, and none of them has been backed with the thing that would settle it.

The PCI claim is different, though, because the product's own privacy policy answers it:

Payment Data: Retained by Stripe according to their data retention policies

Stripe's use of this information is governed by Stripe's Privacy Policy.

Card data goes to Stripe. Stripe is the PCI DSS Level 1 service provider. A platform built on Stripe inherits a much smaller PCI scope — usually SAQ A — and does not thereby become "PCI DSS Level 1". Presenting Stripe's certification as your own, on your own security page, under a heading that says "Compliance & Certifications", is the seam. It's the same move as counting p=none as having DMARC.

The same page can't agree on how many customers it wants

A banner across the top of the homepage:

Early Bird Special: 50% off all plans for first 100 users

Three sections down, the same offer, with a progress bar:

Early Access Progress — 23/200 spots claimed

23+ Early adopters · 177 Spots remaining

One hundred, or two hundred. Both numbers are rendered on one page, in one scroll, by one build. And the arithmetic in the second block is internally fine — 23 plus 177 is 200 — which tells you the two numbers came from different places and nobody read the page top to bottom.

Directly above it:

Early access program closes in: 00 DAYS : 00 HRS : 00 MIN : 00 SEC

The countdown has expired. The offer is still selling. A timer at four zeros is worse than no timer, because it's a machine on the page telling every visitor precisely how long ago the urgency stopped being real.

And the savings comparison underneath is a mirror:

Traditional Payment Processors    ShazPay
Total Annual Loss:  -$13,040      Total Annual Savings:  +$13,040

Same number, opposite sign, with a line-item breakdown on each side that sums to it. Nobody loses exactly what you save. The table is a rhetorical device wearing a spreadsheet's clothes.

There's one more, smaller and stranger. The newsletter block claims 100+ Subscribers and a 100% Open Rate. A hundred percent open rate is not a number an email platform produces; it's a number a placeholder produces.

A payments brand that can be forged

$ dig +short _dmarc.shazpay.link TXT
                                    # nothing

$ dig +short shazpay.link TXT | grep spf
"v=spf1 include:_spf.mx.cloudflare.net ~all"

SPF is published. DMARC is absent entirely, so there's no policy telling a receiver what to do with mail that fails alignment. On a brand whose product is a link you send someone asking them to pay, an unprotected domain is the phishing kit. The security page offers 24/7 threat monitoring; the DNS zone offers nothing that would stop a forged payment request.

The page takes 26 seconds to show its largest element

Lighthouse 12, desktop preset:

performance     30
accessibility   91
best practices  93
SEO             92

largest contentful paint   26.1 s
total blocking time      1,826 ms
transferred                10.6 MB

Ten and a half megabytes for a marketing page. The earlier run on an older Lighthouse gave up partway through with "the page loaded too slowly to finish within the time limit" and reported the paint at 52 seconds; I'm quoting the cleaner number, and the cleaner number is still 26 seconds.

Set that next to the 99.9% uptime SLA on the security page. Uptime and usability are not the same measurement, and a page nobody waits for is down in every way that matters to a customer.

What it gets right

• HSTS is the strongest in this batch: max-age=31536000; includeSubDomains; preload. Plus X-Frame-Options: DENY, X-Content-Type-Options: nosniff and a Referrer-Policy. Only CSP and Permissions-Policy are missing, which is the best header posture of the ten.
• A clean credential scan across nine classes — the bundle came back clear of keys, tokens, placeholders and builder artifacts.
• Fees are stated as numbers, per tier, on the pricing page, before signup. Plenty of payment startups hide this.
• The privacy policy is real work: named retention periods per data class, KYC handling, the Stripe relationship spelled out, CCPA rights enumerated.
• A free tier with no card required, and a demo available without an account.
• The terms name a governing law — Delaware — which two other products in this batch fail to do at all.

The score

Coherence takes the worst score I've given the dimension in this batch: 1.5 of 8. Nothing here is broken code. Every finding above is a claim that contradicts either another claim on the same page or a measurement anyone can take from outside.

What I'd fix first

1. Back the certifications or drop them. Link the SOC 2 report behind an NDA form, name the auditor and the period, and correct the PCI line to say what's true — payments are processed by Stripe, a PCI DSS Level 1 provider. That sentence is more credible than the badge, and it's free.
2. Pick a number for the early-access cap and delete the countdown. If the offer has no deadline, don't render a clock.
3. Publish DMARC. You are a payment-request brand without one.
4. Get the homepage under two megabytes. Ten and a half is a decision, not an accident; something is shipping uncompressed.
5. Cut the mirrored savings table and the 100% open rate. They're the two claims on the page that a technical buyer will test first, and both fail on inspection.

Disclosure

Findings went to the operator before this published. These audits are free and public; the paid version is a Code Health Check, and the rescue work after it is Track 03 on my services page.

One dimension scored Unknown and code access resolves it: whether webhook handlers verify signatures, and whether payment state is reconciled against the processor rather than trusted from the client.