# ShipReady

> Passive read-only launch security scan for live vibe-coded apps.

ShipReady checks a public app URL for leaked secrets and common exposure mistakes, then explains findings in plain English with paste-ready fix prompts for coding agents (Cursor, Lovable, Claude).

## What it scans (read-only)

- Leaked API keys and secrets in the public JavaScript bundle (OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, and similar patterns)
- Exposed private-looking paths: `.env`, `.git/config`, JavaScript source maps
- Open Supabase / Firebase data using the public client key already in the page (logged-out reads only; never writes; never service_role)
- Missing or weak HTTPS / security headers (HSTS, CSP, and related)

## What it does not do

- No logins, password guessing, wordlists, or write operations
- No scanning of localhost, private IPs, or cloud metadata
- Only scan apps you own or have permission to scan

## Who it is for

Builders shipping vibe-coded apps who want a fast perimeter check before real users arrive.

## Pricing

- Free scan: finding counts by severity + the top issue fully explained with one fix prompt
- Single report: $19 one-time — unlock every finding and fix prompt for that scan
- Unlimited: $29/month — full reports whenever you ship

## How to use

1. Open https://shipready.agentdispatchtools.com
2. Paste a public https URL (or run the sample scan)
3. Confirm ownership
4. Read the free report; unlock with Stripe if you want the full list

## Key pages

- Home / scan: https://shipready.agentdispatchtools.com/
- FAQ: https://shipready.agentdispatchtools.com/faq
- Terms: https://shipready.agentdispatchtools.com/terms
- Full product brief for AI: https://shipready.agentdispatchtools.com/llms-full.txt

## Contact / newsletter

Signup on the site. Unsubscribe: email corey@agentdispatchtools.com with the word unsubscribe.
Veteran-owned badge is identity, not the reason to buy — the scan quality is.