Ship fastShip safe.

Paste your GitHub repo URL and we fetch your code via the GitHub API. The free scan runs 5 of 17 security checks — pattern-based scanning for common vulnerabilities. Upgrade to Pro Audit ($9 one-time) and Claude AI runs all 17 checks, including context-dependent issues that patterns physically can't detect — auth logic flaws, missing RLS policies, business logic vulnerabilities. Your code is never stored — it's analyzed in memory and deleted immediately after your report.

That's actually when the AI scan matters most. The free scan covers 5 of 17 security checks — it catches exposed secrets and config issues. But 67% of AI-built apps have critical vulnerabilities in the 12 checks we don't run for free: auth bypass, IDOR, Supabase RLS, business logic flaws. A clean free scan doesn't mean your app is safe. For $9, we run all 17.

Never. Your code is fetched, scanned in memory, and immediately discarded. We don't store, log, or share any of your source code. The only thing we keep is the security report itself.

The free scan checks for: exposed API keys and secrets, insecure headers, common XSS patterns, basic exposure, and dependency issues. The AI scan adds: auth logic analysis, IDOR detection, Supabase RLS validation, business logic review, session management, CSRF protection, rate limiting, API route authorization, and more.

Not at all — that's the whole point. Instead of cryptic codes like "CWE-319," we explain every finding in plain English: what's wrong, why it matters, and exactly how to fix it. Reports include copy-paste fix prompts you can drop directly into Cursor or Lovable.

The free scan covers 5 pattern-based checks — exposed API keys, hardcoded secrets, common XSS, insecure headers. It catches the obvious stuff fast. The AI scan (included in Pro Audit for $9) runs all 17 checks: it understands your authentication logic, checks Supabase RLS policies, and finds business logic flaws that pattern matching physically can't detect. Free catches what grep can find. AI catches what a senior security engineer would find.

GitHub Dependabot checks your dependencies for known CVEs. ShipSafe scans your actual code — the logic you or your AI wrote — for vulnerabilities: exposed secrets, missing auth, injection risks, IDOR, business logic flaws. Plus, our reports are written for non-technical founders, not security engineers.

No. The free scan requires zero payment info — just sign in with GitHub or email and paste your repo URL. You get 5 security checks and a plain-English report completely free. No trial, no expiry.

Yes, cancel with one click from your dashboard — no emails, no hoops. Growth and Shield subscriptions can be cancelled instantly and you keep access through the end of your billing period.