Served our country. Now we guard your code.
Built by a veteran
Paste the public URL of your live app. We scan the page and the JavaScript anyone can already download for leaked keys — OpenAI, Stripe, AWS, database passwords — and write a plain-English fix you can paste into Cursor, Lovable, or Claude.
Example finding
A Stripe secret key is in the JavaScript
The key that starts with sk_live_ can move money. The browser should only have the publishable key. Rotate this one, then call Stripe from the server.
In app.js: sk_liv…9f3a
Run a free scan
The free scan always tells you how many issues showed up, and explains the most serious one in full. The rest of the list is the paid report.
What a scan actually does
Every check is a normal read of something already public. If a stranger can open it in a browser, we can see it too. We stop there.
Secure the perimeter before you ship
About two minutes, then a to-do list.
- 01
Paste the live URL
The address you would send a friend. Not your laptop, not a private IP.
- 02
We only read
ShipReady fetches the public page, same-site scripts, and a few common files. No logins, no wordlists, no changes to your data.
- 03
You get a fix prompt
Each finding is ranked, explained without jargon, and paired with text you can paste into Cursor, Lovable, or Claude.
Start free. Unlock the rest if it is useful.
The free scan shows the counts and the top issue. The full list, with a fix prompt for each finding, is the paid report.
Checkout uses Stripe in test mode when STRIPE_SECRET_KEY is set. Without that key, the buttons explain that payments are stubbed and a local preview can open the full report.
Loyalty first. Then the launch.
Corey is a U.S. military veteran. Service taught him to look after the people beside him and to stay loyal to this country. ShipReady is that standard pointed at software: check the perimeter, tell the truth about a leaked key, and do not leave a builder guessing.
FAQ
What the free scan covers, what $19 and $29 unlock, and what we never do.
What does ShipReady do?
ShipReady runs a passive, read-only scan of a live public app. It fetches the page and same-site JavaScript anyone can already download, looks for leaked API keys and secrets in the bundle, checks common paths like .env and .git/config, probes for open Supabase or Firebase data with the public client key already in the page, and reviews HTTPS and security headers. It never logs in, never writes, and never guesses passwords.
Who is ShipReady for?
Builders who ship vibe-coded apps — Cursor, Lovable, Claude, or similar — and want a quick launch check before real users hit the URL. You should only scan apps you own or have permission to scan.
What is free vs paid?
The free scan always shows how many findings appeared by severity and explains the most serious issue in full, with a fix prompt for that one issue. Unlocking the full report for that scan is a one-time $19 payment. Unlimited is $29 per month and unlocks full reports whenever you scan.
How do I use ShipReady?
Open the site, paste the public https URL of your live app (or run the sample scan), confirm you own it, and start the scan. After about two minutes you land on a report page. Use Stripe checkout to unlock the rest of the findings if you want every issue and paste-ready fix prompt.