FAQ
Straight answers about the free scan, paid reports, and what ShipReady will and will not do.
What does ShipReady do?
ShipReady runs a passive, read-only scan of a live public app. It fetches the page and same-site JavaScript anyone can already download, looks for leaked API keys and secrets in the bundle, checks common paths like .env and .git/config, probes for open Supabase or Firebase data with the public client key already in the page, and reviews HTTPS and security headers. It never logs in, never writes, and never guesses passwords.
Who is ShipReady for?
Builders who ship vibe-coded apps — Cursor, Lovable, Claude, or similar — and want a quick launch check before real users hit the URL. You should only scan apps you own or have permission to scan.
What is free vs paid?
The free scan always shows how many findings appeared by severity and explains the most serious issue in full, with a fix prompt for that one issue. Unlocking the full report for that scan is a one-time $19 payment. Unlimited is $29 per month and unlocks full reports whenever you scan.
How do I use ShipReady?
Open the site, paste the public https URL of your live app (or run the sample scan), confirm you own it, and start the scan. After about two minutes you land on a report page. Use Stripe checkout to unlock the rest of the findings if you want every issue and paste-ready fix prompt.
Does ShipReady attack my site or change anything?
No. Every check is a normal read of something already public. Private networks, localhost, and cloud metadata addresses are refused. A clean report is not a security certificate; if a real key shows up, rotate it first.
What kinds of secrets does it look for?
Patterns for OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, and similar keys, plus high-entropy values next to names like apiKey. Evidence in the report is redacted — you see enough to recognize the leak, not the raw secret.
How do I unsubscribe from the newsletter?
Email corey@agentdispatchtools.com with the address you used and the word unsubscribe. We only store signup emails for the ShipReady newsletter and do not sell them.