You shipped fast. Do you know what's actually exposed?
ShipSafe scans the app your AI coding tool built and tells you, in plain English, what's actually at risk — no code-reading required. A Claude-based review pass reads every finding, throws out anything that doesn't hold up, and explains what could happen if someone found it before you did.
What ShipSafe doesn't do: it doesn't touch your code or fix anything automatically. It finds problems and explains them — you, a developer, or our fix-call option makes the actual fix.
Watch it check your app in plain sight.
Eight mechanical checks run against your live app and your public git history — nothing installed, nothing changed. Then a Claude-based review pass reads the results before any of it reaches you.
$ shipsafe scan --repo your-repo
[1/8]Secrets in git historyclear
[2/8]Client-side secret exposure1 found
[3/8]Unprotected routesclear
[4/8]Authorization (IDOR)1 found — critical
[5/8]Dependency audit (lockfile only)1 found
[6/8]Security headers1 found
[7/8]Database row-level securityclear
[8/8]Webhook + upload validationclear
Claude review passFalse positives removed · plain-English rewrite completedone
4 findings confirmed · 1 critical, 3 minor
Grade capped at C — one critical finding caps the grade no matter how clean everything else is.
Eight checks. Zero guessing.
Each one looks for a specific, common way vibe-coded apps get exposed. Open the + on any card for exactly what it looks for.
Secrets in git history
Checks every past commit for API keys, passwords, and tokens that got committed and never fully removed.
- Looks for
- Keys, passwords, tokens in any past commit
- Why it matters
- Deleting a line today doesn't erase it from history
- You do
- Rotate the exposed key — we never touch your repo
Client-side secret exposure
Checks whether a secret key is sitting in code your browser downloads — meaning anyone can view-source and read it.
- Where
- JS bundles, HTML, config shipped to the browser
- Common cause
- A server-only key pasted into front-end code
- Risk
- Anyone with a browser can read it
Unprotected routes
Checks whether pages or API endpoints that should require login are reachable without one.
- Method
- Requests each route with no credentials attached
- Flags
- Any route that returns real data anyway
- Example
- An admin page anyone can load directly
Authorization (IDOR)
Checks whether changing an ID in the web address lets you see or edit someone else's data — an IDOR, short for Insecure Direct Object Reference.
- Method
- Swaps IDs across two test accounts
- Flags
- Account A reading or editing account B's data
- Why common
- Fast-built apps often check login, not ownership
Dependency audit
Checks your project's lockfile against public vulnerability databases — nothing is installed, run, or executed.
- Source
- Your lockfile only
- Never
- Installs packages or executes any code
- Flags
- Dependencies with known, disclosed vulnerabilities
Security headers
Checks whether your site sends the response headers that stop common browser-based attacks.
- Checks
- Content-Security-Policy, HSTS, X-Frame-Options and similar
- Method
- Reads real HTTP responses from your live site
- Fix
- Usually a few lines of hosting configuration
Row-level security
Checks whether your database enforces row-level security (RLS) — rules the database itself uses to decide which rows a user can see.
- Why it matters
- If the app's own check has a bug, RLS is the backstop
- Method
- Probes for rows readable across account boundaries
- Common gap
- Enabled on some tables, forgotten on others
Webhooks + uploads
Checks whether incoming webhooks are verified as genuinely from the service that sent them, and whether file uploads are restricted.
- Webhook check
- Signature verification present and correct
- Upload check
- File type, size, and storage path restrictions
- Risk if missing
- Forged events, or a file masquerading as an image
A Claude review pass reads everything first.
Before any of it reaches you, a Claude-based review pass reads every finding, throws out anything that doesn't actually check out, and rewrites what's left in plain English — including a concrete "what could happen" scenario for each one. No finding reaches your report without going through this pass.
Free — takes a couple of minutes to start.
See your grade free. Fix it when you're ready.
Every scan is graded A through F, like a report card. The rule is simple, and it's on purpose.
One rule decides the ceiling: any single critical finding caps your grade at a C, no matter how clean everything else is. A serious gap matters more than a dozen small ones.
4 findings confirmed · capped by 1 critical
Order history page has no authorization check
Any logged-in user can open another customer's order history by changing the number in the page's web address. No password or permission check stops them.
What could happen: a competitor, or anyone curious, could page through every customer's order history — names and purchase amounts — just by editing the address bar.
Unlocks with the full report — $149, one time.
Unlocks with the full report — $149, one time.
Unlocks with the full report — $149, one time.
See where you stand
- Your letter grade, A through F
- Finding counts across all 8 categories
- One full critical finding, written in plain English
Fix what matters
- Every finding, in full, in plain English
- A concrete "what could happen" scenario for each one
- Option to book a fix call with a real person
One time. No subscription.
Questions non-developers actually ask.
Plain English, no exceptions — including the jargon we just used above.
What's an IDOR, and why does it matter?
What is row-level security, and why check the database directly?
Will ShipSafe fix my code for me?
I can't read code. Can I still use this?
Does the scan install anything or change my code?
What does a C or lower actually mean?
Get your grade. Decide what's worth fixing.
Tell us where your app lives. We'll grade what your AI coding tool built and show you exactly what's exposed — free.
$149 unlocks every finding in full, plus the option to book a fix call. One time, no subscription.