Is your vibe-coded app
actually ready to launch?
Paste your live URL. In about 30 seconds ShipGrader checks for leaked API keys, exposed .env files, missing security headers, missing Privacy/Terms/Refund pages and pricing promises your terms don’t back up, then gives you an A–F grade.
What we check: security and launch paperwork, in one report
🔑 Leaked secrets
Stripe, OpenAI, Anthropic, AWS, SendGrid, GitHub keys and Supabase service_role JWTs hiding in your JS bundles.
📂 Exposed files
/.env, /.git/config and public source maps that hand out your code and keys.
🛡️ Headers & HTTPS
CSP, HSTS, clickjacking protection, nosniff, Referrer-Policy and http→https redirects.
🗄️ Supabase / Firebase
Detects your backend and flags the Row Level Security and Security Rules checks you must do.
📜 Legal pages
Privacy Policy, Terms of Service, Refund policy and contact info, including client-rendered SPA routes.
🍪 Cookie consent
Google Analytics, Meta Pixel, Hotjar, PostHog and more loading without a consent banner.
💳 Pricing vs terms
Your pricing says “money-back guarantee” or “14-day free trial” but your terms say nothing? We flag it before a chargeback does.
🚀 Launch basics
Title, meta description and social preview image so your launch post on X doesn’t look broken.
Why this matters
AI builders ship fast, and that includes the mistakes. A secret key in a frontend bundle, a Supabase table with RLS switched off, or an OpenAI key with no spend cap is how founders end up with a five-figure cloud bill or a leaked user database in their first week. The fix is usually 10 minutes of work once you know where to look.
| Typical security scanner | ShipGrader | |
|---|---|---|
| Leaked keys, exposed files, headers | ✓ | ✓ |
| Supabase / Firebase guidance | Sometimes | ✓ |
| Privacy / Terms / Refund page check | — | ✓ |
| Pricing-vs-terms consistency | — | ✓ |
| Legal starter text tailored to your stack | — | ✓ |
| Plain-English fixes | Varies | ✓ |
Pricing
Full Report
$29
- Every finding with step-by-step fixes
- Masked evidence (where we found it)
- Pricing-vs-terms consistency check
- Privacy Policy, Terms & Refund starter text for your stack
- Printable / PDF
Monitoring (coming soon)
$12/mo
- Weekly re-scan
- Email alert when a new key or file leaks
- Grade history
Guides
FAQ
Is the scan safe to run on my production site?
Yes. ShipGrader makes a small number of ordinary GET requests (about 15–45), exactly like a visitor’s browser: your pages, your public JS bundles and a few well-known file paths such as /.env. It never logs in, submits forms, guesses passwords, sends write requests or tries to exploit anything.
Can I scan someone else’s site?
No. You may only scan sites you own or are explicitly authorized to test. Our Terms make that a condition of use.
Does an A grade mean my app is secure?
No scanner can promise that. We only see what’s public. Your database rules, server code and API authorization still need review. The report tells you exactly what to check by hand, for example Supabase RLS.
Are the legal templates lawyer-approved?
They’re starter text tailored to the services we detect, so you’re not launching with a blank page. Fill in the brackets, make them match what you actually do, and have a lawyer review them if you handle sensitive data or operate in regulated markets.
What if I find a leaked key?
Revoke and rotate it at the provider first, then move the call to a server or edge function. The full report has provider-specific steps.