Paste a public GitHub repo or live URL. ShipCheck scans your vibe-coded app for the launch killers AI tools leave behind, then hands you a plain-English report with copy-paste fixes.
Passive, read-only checks. Nothing is stored. Any secrets found are masked. Takes ~5–30 seconds.
→ scanning 214 files, 3 pages… ✗ CRITICAL OpenAI key committed in src/lib/ai.ts (sk-…a9F2) ✗ HIGH .env file tracked in git ✗ MEDIUM No Content-Security-Policy header ✓ build passes · HTTPS ok · 0 broken links Score: 61/100 · 3 fixes ready to copy-paste
These are the things that get apps hacked, rate-limited, or ignored on launch day.
Secrets hardcoded in your repo, masked in the report so the scan doesn't leak them again.
Env files in git, plus vars your code uses that are missing from .env.example.
Build script and lockfile checks today. Full npm run build on a clean machine is coming.
CSP, HSTS, X-Frame-Options, HTTPS. The basics most AI-generated apps skip.
Dead links and 404s that make a launch look unfinished.
A Lighthouse speed score with the biggest wins called out.
No setup, no CLI, no config files.
A public GitHub repo or your live site URL.
Passive, read-only checks. We never attack your site.
Every issue explained in plain English, with the exact fix.
Built for vibe coders, AI and agent builders, and indie or gaming devs shipping fast.
Email us and we'll let you know the day AI-written fix reports go live.
hello@tryshipcheck.comYes. ShipCheck is free during the beta, with every finding shown and no signup.
Leaked API keys and secrets, committed or publicly served .env files, HTTPS and security headers (CSP, HSTS, X-Frame-Options and others), build hygiene for GitHub repos, broken links, and mobile page speed.
Yes. Scans are passive and read-only, like a normal visitor or crawler. Nothing is stored, and any secrets found are masked in the report.
Any public website or GitHub repo, including apps built with Lovable, Cursor, Bolt, v0, Replit, Next.js, Vite and others.
Yes. POST https://tryshipcheck.com/api/scan with JSON {"target":"https://yourapp.com"} returns the score and findings as JSON. You can also link to https://tryshipcheck.com/?scan=yourapp.com.