ShipShapeScan

Pre-launch inspection · free

Is your vibe-coded app safe to launch?

Paste a public URL. ShipShape looks only at what any visitor can already see — leaked keys, exposed files, missing headers — and stamps a grade.

shipshape@yardpassive

# passive only. no login, no writes, no database queries. secrets are masked. this is not a guarantee. ▋

  • Lovable
  • Bolt
  • v0
  • Cursor
  • Replit

Draft marks

How the free check works

  1. 01

    Paste the live URL

    Use the public address of an app you own or are allowed to test. Lovable, Bolt, v0, Cursor, and Replit deploys are the usual case.

  2. 02

    We fetch what a browser can

    The homepage, its same-origin scripts, and a fixed list of well-known files. No login, no wordlists, no writes.

  3. 03

    You get a grade

    A to F, every finding title, and the fix for the single most serious issue. The rest of the detail ships with the paid report.

Survey sheet

What we check

Active probes — database rules, admin routes, unauthenticated APIs — wait for the paid report, and only after you prove you own the domain.

  • Item 1

    Secrets in HTML and JavaScript

    Stripe secret keys, OpenAI and Anthropic keys, AWS keys, GitHub tokens, private keys, and other high-entropy assignments. Values are masked.

  • Item 2

    Supabase and Firebase client config

    We report the anon key and the client config. A service_role key is flagged. We do not query tables or rules on this free check.

  • Item 3

    Security headers

    Content-Security-Policy, HSTS, clickjacking protection, X-Content-Type-Options, and Referrer-Policy.

  • Item 4

    HTTPS

    Whether the URL stays on HTTPS, including redirects. Plain HTTP is a finding.

  • Item 5

    Exposed files

    Single GET requests for .env, .git/config, .git/HEAD, AWS credentials, .npmrc, and source maps the page points at.

  • Item 6

    Cookie flags

    Secure, HttpOnly, and SameSite on cookies the public response sets.

Not in this inspection

  • No brute force, fuzzing, or password guessing
  • No writes and no login attempts
  • No path lists beyond those well-known files
  • No Supabase or Firebase queries

Tariff

Pricing

The Quick Check is free. The paid tiers are not on sale yet. The buttons say coming soon and save an email. Nothing is charged.

In service

Quick Check

€0 free

The public view of the app: headers, files, and secrets a visitor can already see.

  • Passive checks on a URL you are allowed to test
  • Grade from A to F
  • Every finding title and severity
  • Full detail and a fix for the single most serious issue
Run inspection

After a Quick Check

Launch Report

€19 one-off

The same passive check, with every finding open, fix snippets, and a PDF.

  • Sold from a finished Quick Check
  • Where each finding showed up, secrets still masked
  • Copy-paste fixes for Supabase, Firebase, Vercel, and Next.js
  • A private link that does not expire, plus a PDF
Run a check, then unlock

Coming soon

Report + Fix PR

€39 one-off

The report, plus a pull request that moves the secret and tightens the config.

  • Everything in the Launch Report
  • A GitHub pull request with the fix
  • Header config and a secret moved server-side
  • RLS migration when that is the actual issue

Coming soon

Monitor

€9 per month

A weekly pass, and another one each time you deploy.

  • Weekly re-scan of the verified domain
  • Re-scan on a new Vercel deploy
  • Email when a new critical shows up
  • Homelab checks come later, not in this price