New: The State of Indie Launches: July 2026. The framework layer is the same everywhere. The payment layer is not. Read

← Back to Structure React Applications

Owner tools

For the owner of Structure React Applications (Visit site).

Ownership

This launch is unclaimed.

Claim this launch to get an owner link, re-scan after fixes, track your score improvements, or remove your site from StackScope entirely.

Claim this launch

Start here

Three fast-win fixes from the list below, ordered by impact. Each is a drop-in change you can finish in under 30 minutes.

  1. Add a privacy policy page Analytics detected on this site, so a privacy policy is a legal requirement under GDPR and US state privacy laws, not optional.
  2. Add a robots.txt file
  3. Add a sitemap.xml

3 more score-affecting fixes below, plus advisory items.

Fixes that improve your score

Security

  • HIGHAdd the missing security response headers
    Missing: Referrer-Policy, X-Frame-Options, Permissions-Policy, Strict-Transport-Security
    WhyEach header limits a class of browser-side attack: clickjacking, XSS, MIME sniffing, plaintext fallback. Missing headers leave default-permissive behaviour in place.
    WhereMost are one line each in your server config, reverse proxy, CDN, or framework headers.
    Learn more
    Why this matters & sources

    Per-header consequence:

    • Strict-Transport-Security: Tells browsers to only ever load your site over HTTPS, even if a user types the URL without https://. Without it, a first-visit on coffee-shop wifi can be silently downgraded to HTTP and intercepted.
    • X-Frame-Options: Stops other sites loading yours inside an invisible iframe to trick users into clicking buttons they can't see (clickjacking).
    • Referrer-Policy: Controls how much of the current URL is sent to third-party sites and analytics. The default leaks the full path, including query strings that may contain tokens or user IDs.
    • Permissions-Policy: Turns off browser features your site doesn't use (camera, microphone, geolocation, payment) so an injected script can't trigger them.

Legal & compliance

  • HIGHAdd a privacy policy page
    Analytics detected on this site, so a privacy policy is a legal requirement under GDPR and US state privacy laws, not optional.
    WhyDocuments what personal data you collect and how you use it. Without one, it's hard to demonstrate basic GDPR / CCPA compliance to regulators or users.
    WhereUse a free generator like Termly or Iubenda to produce one in minutes, then link from your footer.
    Learn more

Discoverability

  • MEDIUMAdd a robots.txt file
    WhyTells search engines and bots which pages to crawl and which to skip. Without one, crawlers default to indexing everything they can reach, including admin paths and staging URLs.
    WhereCreate /robots.txt at the site root. Most frameworks have a built-in path (Next.js app/robots.ts, Astro public/robots.txt).
    Learn more
  • MEDIUMAdd a sitemap.xml
    WhyHelps search engines discover all your pages, including deep-linked ones not in the navigation. Without one, only pages reachable via crawl-from-homepage get found.
    WhereGenerate /sitemap.xml and reference it from robots.txt with a Sitemap: line. Frameworks usually generate it (Next.js app/sitemap.ts, Astro @astrojs/sitemap).
    Learn more

Page basics & SEO

  • MEDIUMSet a custom title and meta description
    Missing on your page: a custom <title>.
    WhyThese are the first things users see in search results. They're the only chance to earn a click before someone visits.
    WhereAdd <title> and <meta name="description"> to each page's <head>.
    Learn more
  • MEDIUMAdd Twitter card meta tags
    No Twitter card tags were detected on your page.
    WhyWithout them, links shared on X render as bare text instead of a rich preview card with image, title, and description. Rich cards have meaningfully higher CTR.
    WhereAdd <meta name="twitter:card" content="summary_large_image">, plus twitter:title, twitter:description, and twitter:image to your <head>.
    Learn more

Optional improvements

These don't change your StackScope score but cover SEO, agent-readiness, security-researcher discoverability, and compliance items worth addressing.

Security

  • LOWAdd /.well-known/security.txt
    WhyLets security researchers report vulnerabilities responsibly through a published contact channel.
    WhereCreate /.well-known/security.txt with a Contact: email and Expires: date.
    Learn more

Legal & compliance

  • HIGHGate analytics behind consent
    Analytics set tracking cookies on our visit with no opt-in step. If you gate this for real visitors in a way our crawl didn't trigger, you can ignore it.
    WhyUK/EU GDPR requires opt-in before analytics scripts fire; about half of US state privacy laws now require honouring the Global Privacy Control browser signal as a universal opt-out.
    WhereDrop in Cookiebot, Usercentrics, Osano, or Iubenda Consent, or hand-roll a banner plus Google's Consent Mode v2.
    Learn more
    Why this matters & sources

    The legal landscape: UK/EU GDPR treats analytics as personal-data processing that requires opt-in consent before scripts fire. About half the US state privacy laws now in force (California, Colorado, Texas, Connecticut, Oregon, Montana, Delaware, New Hampshire, New Jersey, Nebraska) require honouring the Global Privacy Control (GPC) browser signal as a universal opt-out, and California's January 2026 regulations require visibly indicating when a GPC signal has been honoured.

    Sources: IAPP US state privacy tracker (iapp.org/resources/article/us-state-privacy-legislation-tracker), California AG on GPC (oag.ca.gov/privacy/ccpa/gpc), EDPB consent guidelines (edpb.europa.eu).

Email security

  • LOWAdd MTA-STS
    No MTA-STS DNS record published.
    WhyPrevents mail to your domain being downgraded to plaintext mid-flight by a network attacker. Most launches don't have this, so deploying it puts you a tier above generic email-security checks.
    WherePublish a TXT record at _mta-sts.{your-domain} plus a policy file at https://mta-sts.{your-domain}/.well-known/mta-sts.txt.
    Learn more
  • LOWAdd a TLS-RPT record
    No TLS-RPT record at _smtp._tls.{domain}.
    WhyReceivers can tell you when STARTTLS handshakes to your mail server fail. Without it, silent TLS failures are invisible.
    WherePublish one TXT record at _smtp._tls.{your-domain} like v=TLSRPTv1; rua=mailto:[email protected].
    Learn more

Page basics & SEO

  • LOWTrim your meta description to under 160 characters
    Currently 4473 characters: "Stop letting components, hooks, services, and utils become the architecture.Large React applications rarely become difficult because they need one more folder. They become difficult when ownership is unclear, business rules leak into components, HTTP payloads spread through the UI, and every generic directory becomes a dumping ground.Structure React Applications gives your AI coding agent an opinionated decision framework for organizing and changing production React + TypeScript codebases.It teaches the agent to reason about the architecture before it moves files: who owns the behavior, what the module may depend on, what it exposes publicly, and how far a future change should propagate.WHAT THE SKILL GUIDES YOUR AGENT TO DO• Organize around user capabilities and business ownership—not file types.• Separate application composition, feature workflows, domain rules, and shared foundations.• Keep domain logic independent of React, routers, browsers, query caches, and HTTP response shapes.• Put API transport mechanics and product-specific adapters at the correct boundaries.• Expose small public module APIs instead of private deep imports.• Maintain one-way dependency flow: app → features → domains → shared.• Promote code to shared only when its behavior, name, and ownership are genuinely stable.• Place tests by ownership when the repository permits them.• Refactor one changing vertical slice at a time instead of proposing a cosmetic rewrite.NOT ANOTHER FOLDER-TREE TEMPLATEA folder tree cannot decide whether canCancelOrder belongs beside a dialog, in an order domain, or in a generic utility file. This skill includes the decision criteria behind the structure, so the agent can adapt it to Next.js, React Router, Vite, an established monorepo, or an imperfect legacy codebase.Repository instructions and framework conventions still win. The skill tells the agent to inspect the existing code, preserve unrelated changes, avoid empty abstractions, and state conflicts before acting.WHAT YOU RECEIVE• Production-ready SKILL.md workflow.• Detailed architecture reference with a folder structure and placement matrix.• Feature-owned vertical-slice and framework-independent domain examples.• API adapter, DTO mapping, and public module API examples.• Cross-feature composition and incremental migration guidance.• Architecture review findings with severity levels.• Buyer installation guide with ready-to-use prompts.• Individual commercial license for unlimited personal, employer, and client projects.No runtime package, API key, dependency, or build step is required.WORKS WITH CODEX AND CLAUDE CODEBoth products support SKILL.md skills with supporting files and automatic discovery. Invoke $structure-react-applications in Codex or /structure-react-applications in Claude Code. Other agents can use the Markdown workflow when they support skills or project instructions.USEFUL FOR• Senior React engineers and technical leads using AI coding agents.• Teams starting a production React or Next.js application.• Features spanning UI, state, API calls, and business rules.• Reviews of deep imports, dependency cycles, leaking transport types, and unclear ownership.• Incremental modernization of codebases with generic top-level folders.EXAMPLE PROMPTUse the Structure React Applications skill to add the cancel-order capability as one complete vertical slice. Explain its owner, public API, and allowed dependency direction before editing. Preserve the repository’s existing conventions and avoid a broad restructure.LICENSEOne purchaser may use and privately modify the skill across unlimited personal, employer, and client projects. Sharing, publishing, reselling, sublicensing, or redistributing the original or modified skill files is not allowed. Each additional direct user needs a separate license. Outputs created with assistance from the skill remain yours, subject to applicable law and third-party rights.ABOUT THE AUTHORI’m Moussa Saidi, a hands-on React technical lead. This skill operationalizes the architecture decisions I use to make large React applications easier to understand, safer to change, and easier for teams to own.Read the free architecture guide:https://www.moussasaidi.dev/en/blog/how-i-structure-a-large-react-applicationQuestions or team licensing: [email protected] product by Moussa Saidi. Not affiliated with or endorsed by OpenAI, Anthropic, Meta, React, or any AI-agent vendor.Review on Product Hunt"
    WhyGoogle truncates around 155-160 characters on desktop SERPs (less on mobile), so anything past that won't appear in the snippet.
    WhereEdit your <meta name="description"> tag. Put the most click-worthy phrase first.
    Learn more

Performance

  • MEDIUMCompress your largest image
    Largest image transfers 1.2 MB. Oversized hero/banner images are the most common cause of slow first paint on indie launches.
    WhyLarge images delay the largest-contentful-paint and burn mobile data before the page is usable.
    WhereExport at the displayed size, convert to WebP/AVIF, and compress (Squoosh, sharp, or your framework's image component such as Next.js <Image>).
    Learn more
  • MEDIUMSet width and height on your images
    2 images render without explicit width/height.
    WhyWithout intrinsic dimensions the browser can't reserve space before the image loads, so content jumps as it arrives (cumulative layout shift).
    WhereAdd width and height attributes (or an aspect-ratio CSS rule). Framework image components set these for you.
    Learn more
  • LOWServe right-sized images
    1 image is downloaded at more than twice the displayed size.
    WhyShipping a 2000px image into a 400px slot wastes bandwidth and slows loading, especially on mobile.
    WhereResize to the displayed dimensions, or use srcset/sizes (or a framework image component) to serve per-viewport variants.
    Learn more
  • LOWAdd alt text to your images
    1 image has no alt attribute.
    WhyScreen-reader users get no description, and search engines lose a signal about the image content.
    WhereAdd a concise alt="..." to each image (an empty alt="" is correct only for purely decorative images).
    Learn more

Agent / AI

  • LOWAdd an llms.txt file
    WhyHelps AI models understand your site's content and how to use it. Not yet a standard but gaining adoption.
    WhereCreate /llms.txt at the site root with a brief overview and key URLs.
    Learn more
  • LOWDeclare a Content-Signal in robots.txt
    WhyStates how you'd like AI systems to use your content (training, search, agent input). Without it, AI crawlers fall back to whatever default policy each vendor applies.
    WhereAdd a Content-Signal: line to your robots.txt.
    Learn more
  • LOWAdd Link response headers
    WhyLets agents discover your sitemap, privacy policy, and docs without parsing HTML, which most lightweight agents skip.
    WhereSet Link: response headers in your server config or framework middleware.
    Learn more

If a tip looks wrong (for example it says "add a consent banner" and you already have one) the detection's the bug, not you. StackScope sees what's public from the outside: HTTP response, rendered HTML, cookies, and DNS. We can miss vendors that load behind consent, are self-hosted, or use an install shape we haven't fingerprinted yet. Email [email protected] and we'll look into it.

Copy into Cursor, Claude, or ChatGPT

This prompt includes the detected stack and only the fixes StackScope found. It asks the AI to make concrete file-level changes, not a vague website review.

Score-affecting basics only. Ask your AI to handle these first; come back for the optional hardening once they're done.

Everything: score-affecting fixes plus optional email security, agent metadata, and best-practice items. Longer prompt, more for an "all in one" agent run.

Using an autonomous agent?

Point the agent at this SKILL.md URL and ask it to follow the skill. The framing stops agents defaulting to an open-ended page review.

https://stackscope.dev/launch/uupk90ov/skill.md

Share your score

Your score card renders automatically when you share the link.

Or embed a badge

Two badge options. Pick whichever fits your story.

Current score

Shows the latest score and updates within a few minutes of any recrawl. Best for ongoing display: if you fix something and recrawl, the badge reflects the new score automatically.

StackScope score 

<a href="https://stackscope.dev/launch/uupk90ov/structure-react-applications"><img src="https://stackscope.dev/badge/uupk90ov/current.svg" alt="StackScope score for Structure React Applications" height="24" /></a>

Launch score

Pinned to your launch-day snapshot and never changes. Marked with a small gold corner ribbon. Best for press kits, launch retrospectives, or anywhere you want a permanent record of how you shipped.

StackScope launch score 

<a href="https://stackscope.dev/launch/uupk90ov/structure-react-applications"><img src="https://stackscope.dev/badge/uupk90ov.svg" alt="StackScope launch score for Structure React Applications" height="24" /></a>

Using a Content-Security-Policy? Both badges are <img> tags from our domain, so your CSP needs to allow them. Add stackscope.dev to your img-src directive (example: img-src 'self' stackscope.dev;). Without it, browsers silently block the badge and visitors see a broken image.