About ShipGuard

ShipGuard is a passive pre-launch security scanner for apps built with AI tools such as Lovable, Bolt.new, Cursor, v0 and Replit. It looks for the configuration mistakes that most often slip into fast-shipped apps and gives copy-paste fix prompts for your tool.

Scanning ethics

• Authorization. Scans started from the website require you to confirm you own the site or are authorized to inspect it.
• Passive and read-only. We send ordinary GET requests for the page, its same-site JavaScript bundles, and a short list of well-known paths (/.env, /.env.local, /.git/config, /.git/HEAD, *.js.map). No logins, form submissions, fuzzing, brute force or exploit attempts.
• Small footprint. Roughly 10–40 requests per scan, at most 4 in parallel, an 8-second timeout per request and a ~25-second total budget.
• Supabase. If your site ships a public Supabase anon key (which is normal), we use that same public key to check whether the API schema and storage bucket list are enumerable. We never query table rows or download stored objects, and we never claim an RLS bypass from these signals alone.
• Network safety. We only scan public http/https hosts on standard ports. Private, loopback, link-local and cloud-metadata addresses are refused, including via redirects or DNS changes.
• Secrets are redacted. Any detected credential is reduced to its first 6 characters before it is stored or shown. We never store full keys and never use them.
• Evidence labels. Each finding says whether it is a heuristic match (a string that looks like a secret) or confirmed (directly observed in an HTTP response, such as a missing header).
• Responsible disclosure. Reports with an open critical or high finding are marked noindex, kept out of our sitemap and not submitted to search engines until a rescan shows the issue fixed.
• Outreach. When we notify a site owner about a scorecard, every email is reviewed and approved by a person first; nothing is sent automatically. Reply “no thanks” and we won't contact you again.

Identify our scanner

Requests carry the User-Agent:

ShipGuardScanner/1.0 (+https://getshipguard.com/about)

Limits

A passive scan cannot see your server code, authorization logic or database policies. A good grade means none of our checks failed — it is not a guarantee of security.

Contact & opt-out

Questions, corrections or opt-out requests: hello@getshipguard.com. See also our Terms and Privacy Policy.