You vibe-coded it.
Is it safe to launch?
ShipAudit checks your live app in 20 seconds for the mistakes AI agents make: leaked Stripe and Supabase keys, open .env files, missing security headers, invisible-to-Google-and-ChatGPT pages, and missing privacy and refund pages. Every issue comes with a prompt you paste into Cursor to fix it.
Security basics
Secret keys in your JS bundle, exposed .env/.git, HTTPS, CSP, HSTS, clickjacking.
Google & AI visibility
robots.txt, sitemap, meta and OG tags, JSON-LD, llms.txt, and whether ChatGPT search can read you.
Launch & legal
Privacy policy, terms, and the refund policy Stripe expects.
Pricing
Full report: $29
Every finding, severity, and a copy-paste Cursor fix prompt for each. One-time, per domain, re-scan for 30 days.
Scan first, then unlockFix-It: $149
We make the fixes in your GitHub repo and open a pull request you review and merge. Read-only repo access you can revoke.
Get Fix-ItNot a security certification or penetration test. See terms.
Stop the mistakes before they ship
Building on Next.js + Supabase? RulesDrop's $19 Cursor rules pack makes your agent get RLS, secrets and Stripe webhooks right the first time.
FAQ
What does ShipAudit check?
ShipAudit runs passive, read-only checks of your public website: HTTPS and redirects; security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy); secret keys leaked in your public JavaScript (Stripe secret keys, Supabase service_role keys, OpenAI/Anthropic and AWS keys); publicly downloadable .env and .git files; robots.txt, sitemap.xml, title/meta/Open Graph tags, JSON-LD structured data, llms.txt and whether AI search crawlers like ChatGPT and Perplexity can read your site; and links to a privacy policy, terms and refund policy.
What is a Cursor fix prompt?
Every issue in the full report comes with a prompt you paste into Cursor (or Claude Code, Codex, Windsurf). It tells your AI agent exactly what to change and how to verify it, so you fix the issue without needing to be a security expert.
How much does it cost?
The quick check is free and shows your score and top 3 issues. The full report with every finding and every fix prompt is $29 one-time per domain. Fix-It is $149: we fix the issues in your repo and open a pull request for you to review.
Is ShipAudit a security certification or penetration test?
No. ShipAudit is an automated, passive launch-readiness checklist. It does not log in, test your API or database, or attempt any attack. A good score does not mean your app is secure. It catches common, embarrassing mistakes before launch.
Is it safe to scan my site?
Yes. ShipAudit only makes normal page requests a browser or search engine would make, limited to a few dozen requests per scan. It never submits forms, never logs in, and never probes your database. You must confirm you own the site or have permission to scan it.
What happens if you find a leaked key?
We show only a masked version (for example sk_live_ab…wxyz) so you can find it. We never use, test or store the key. Rotate it immediately in the provider's dashboard; the fix prompt walks you through it.
Do you store my scan results?
No database. Results are generated on request and returned to your browser. We keep standard, short-lived server logs (IP, time, scanned domain) for abuse prevention. See the privacy policy.
Which stacks does it work with?
Any public website. It's built for apps made with Cursor, Lovable, Bolt, v0, Replit and Claude Code, especially Next.js + Supabase + Stripe, Vite/React, and similar stacks on Vercel, Netlify or Cloudflare.
Can I get a refund?
Yes. If the full report doesn't help, email us within 14 days for a refund.