Find what your AI‑built app leaks before your users do.
Paste your live URL. Shipshape reads only what any visitor can see. It never logs in, never stores your secrets, and gives you dated proof you're ready to ship.
Four launch gates
Data Gate
Catches a Supabase service_role key sitting in your client JS, where any visitor could read or edit your whole database.
Wallet Gate
Flags an OpenAI key called straight from the browser, so a stranger can run paid requests on your account.
Paid-State Gate
Confirms a paid checkout actually flips the user to paid, instead of charging them and unlocking nothing.
Agent-DB Gate
Reviews AI-generated SQL for a table left with no row-level security, exposed to every logged-in user.
How it works
Scan
Point Shipshape at your live URL. Every finding shows what we saw, why it matters, and redacted proof.
Fix
Each finding ships a paste-ready prompt for Cursor, Lovable, Bolt, or v0. Apply it, then re-scan to verify.
Prove
Clear the gates and mint a dated Launch Certificate, verifiable at a public link you can share.
A black-box "you're clean" isn't proof. This is.
Re-scan clean and Shipshape mints a dated, redacted Launch Certificate. It says what passed, what failed, and what wasn't tested — verifiable at a public link.
Free to find. Cheap to prove.
The scan and the verdict are free. Pay only when you want the fixes or ongoing watch.
Copy-paste fixes for your builder, before and after snippets, and a re-scan.
Scan, then fixWeekly re-scans and an alert if a new critical issue appears.
Watch my appWant a human expert to review it before launch? Request a Launch Review — we reply with scope + a quote.
Request a Launch Review →
Straight answers
Does Shipshape need my code or GitHub repo?
No. Shipshape scans your deployed, public URL read-only — exactly what any browser can see. No repo access, no file upload, no login.
Is the Launch Certificate a security guarantee?
No. It attests that a dated check ran and which gates passed. It is not a pentest, certification, or guarantee — and the certificate says so itself.
Can I just ask ChatGPT instead?
ChatGPT can list what to check. Shipshape checks your actual live app and returns concrete redacted evidence, a verdict, and the exact fix to paste back into your builder.
What happens to surfaces behind a login?
We mark them "not checked" rather than guess or try to bypass them. Deeper database checks run only after you verify ownership.
We hold ourselves to the same scan.
Run Shipshape against Shipshape, live — see our own report, grade, and gates.
We never log in, attack, or store your secrets — only a redacted fingerprint as proof. And we tell you exactly what we did not test.
We publish how often we're right on a known corpus — false negatives shown, not hidden.