Scan terms

ShipReady is a read-only check for an app you already put on the internet. You may scan a URL only if you own that app or you have permission from the person who does. Scanning someone else's product to hunt for keys is not allowed.

A scan fetches the public page, the scripts that page loads from the same site, and a short fixed list of paths (such as /.env and /.git/config). If the page contains a Supabase or Firebase client config, ShipReady may send a few logged-out reads, limited to one row or a shallow root, using the public client key already in that JavaScript. ShipReady does not send writes, does not guess passwords, and does not use a Supabase service_role key to read data.

Private networks, localhost, and cloud metadata addresses are refused. The point of the tool is a public URL you would send a user, not a tour of your laptop.

Findings are clues, not a certificate. A clean report does not mean the app is safe. If a real key shows up, rotate it in that product's dashboard before you do anything else. Reports store redacted evidence, not the raw secret, on the machine running ShipReady.

You are responsible for what you do with a report, including any prompt you paste into a coding tool.