# ShipAudit

> ShipAudit is a launch-readiness checker for vibe-coded apps (built with Cursor, Lovable, Bolt, v0, Replit, Claude Code). Paste a URL to get a free score and top 3 issues; the $29 full report lists every finding with severity and a copy-paste Cursor fix prompt. Fix-It ($149) delivers the fixes as a GitHub pull request. Passive, read-only checks; not a security certification.

## Pages
- [Free check](https://shipaudit.dev/check/)
- [Pricing](https://shipaudit.dev/#pricing)
- [Launch checklist guide](https://shipaudit.dev/guide/): step-by-step pre-launch checklist
- [FAQ](https://shipaudit.dev/faq/)
- [Terms and disclaimer](https://shipaudit.dev/terms/)
- [Privacy](https://shipaudit.dev/privacy/)

## FAQ
- **What does ShipAudit check?** ShipAudit runs passive, read-only checks of your public website: HTTPS and redirects; security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy); secret keys leaked in your public JavaScript (Stripe secret keys, Supabase service_role keys, OpenAI/Anthropic and AWS keys); publicly downloadable .env and .git files; robots.txt, sitemap.xml, title/meta/Open Graph tags, JSON-LD structured data, llms.txt and whether AI search crawlers like ChatGPT and Perplexity can read your site; and links to a privacy policy, terms and refund policy.
- **What is a Cursor fix prompt?** Every issue in the full report comes with a prompt you paste into Cursor (or Claude Code, Codex, Windsurf). It tells your AI agent exactly what to change and how to verify it, so you fix the issue without needing to be a security expert.
- **How much does it cost?** The quick check is free and shows your score and top 3 issues. The full report with every finding and every fix prompt is $29 one-time per domain. Fix-It is $149: we fix the issues in your repo and open a pull request for you to review.
- **Is ShipAudit a security certification or penetration test?** No. ShipAudit is an automated, passive launch-readiness checklist. It does not log in, test your API or database, or attempt any attack. A good score does not mean your app is secure. It catches common, embarrassing mistakes before launch.
- **Is it safe to scan my site?** Yes. ShipAudit only makes normal page requests a browser or search engine would make, limited to a few dozen requests per scan. It never submits forms, never logs in, and never probes your database. You must confirm you own the site or have permission to scan it.
- **What happens if you find a leaked key?** We show only a masked version (for example sk_live_ab…wxyz) so you can find it. We never use, test or store the key. Rotate it immediately in the provider's dashboard; the fix prompt walks you through it.
- **Do you store my scan results?** No database. Results are generated on request and returned to your browser. We keep standard, short-lived server logs (IP, time, scanned domain) for abuse prevention. See the privacy policy.
- **Which stacks does it work with?** Any public website. It's built for apps made with Cursor, Lovable, Bolt, v0, Replit and Claude Code, especially Next.js + Supabase + Stripe, Vite/React, and similar stacks on Vercel, Netlify or Cloudflare.
- **Can I get a refund?** Yes. If the full report doesn't help, email us within 14 days for a refund.

## Related
- [RulesDrop](https://rulesdrop.com): Cursor rules packs for secure Next.js + Supabase apps.