What does the free scan include?

A letter grade (A–F), pass/fail counts, and one finding shown in full with its location and an AI fix prompt. The remaining findings are listed by severity and unlocked with the Launch Pass.

Is the scan safe to run on my production site?

Yes. It is passive: a few dozen ordinary GET requests with a strict 8-second timeout per request and a ~25-second total budget. It never logs in, submits forms, or tries exploits.

Do you store my secrets?

No. Detected secret values are masked before the report is saved; only a short prefix and suffix are kept so you can identify which key to rotate.

Does an A grade mean my app is secure?

No. It means none of our passive checks failed. Authorization bugs and server-side logic need testing that a passive scanner cannot do.

Which tools does it work with?

Any public website. The checks are tuned for apps built with Lovable, Bolt.new, Cursor, v0, Replit and Supabase.

For apps built with Lovable · Bolt · Cursor · v0 · Replit · Supabase

Find the leaks before your launch post does.

ShipGuard runs a 25-second passive security check on your deployed app: exposed API keys, open Supabase surfaces, public.envfiles and missing headers — with copy-paste fix prompts for your AI editor.

What the scan checks

Critical

Leaked secrets in your JS

Stripe sk_live_, OpenAI sk-proj-, Anthropic, Resend and Supabase service_role keys shipped to the browser. Publishable keys are ignored.

High

Supabase exposure

If your anon key is public (normal), we check whether your schema and storage buckets are enumerable — without reading your rows.

Critical

Vibe-coding artifacts

Public /.env, /.env.local, /.git/config and source maps — confirmed by content, so SPA catch-all pages don't trigger false alarms.

Medium

Headers & CORS

HSTS, Content-Security-Policy, clickjacking protection, nosniff, HTTPS redirect and overly permissive CORS.

1. Paste your URL

We normalize the domain, resolve it, and refuse private or internal addresses.

2. Passive checks

Your HTML and same-site bundles are pattern-matched; a handful of well-known paths are verified by content.

3. Fix with your AI

Every finding comes with a prompt you can paste into Cursor, Lovable, Bolt, v0 or Replit.

Launch Pass — $29 One-Time

Unlock every finding, exact locations and AI fix prompts for one domain. No subscription.

See pricing

Popular fix guides

All 26 guides →

FAQ

What does the free scan include?: A letter grade (A–F), pass/fail counts, and one finding shown in full with its location and an AI fix prompt. The remaining findings are listed by severity and unlocked with the Launch Pass.
Is the scan safe to run on my production site?: Yes. It is passive: a few dozen ordinary GET requests with a strict 8-second timeout per request and a ~25-second total budget. It never logs in, submits forms, or tries exploits.
Do you store my secrets?: No. Detected secret values are masked before the report is saved; only a short prefix and suffix are kept so you can identify which key to rotate.
Does an A grade mean my app is secure?: No. It means none of our passive checks failed. Authorization bugs and server-side logic need testing that a passive scanner cannot do.
Which tools does it work with?: Any public website. The checks are tuned for apps built with Lovable, Bolt.new, Cursor, v0, Replit and Supabase.