ShipGuardScan a site
A

Security scorecard

getshipguard.com

Score 98/100 · 0 failed · 2 warnings · 8 passed · 1 not applicable

Scanned 2026-10-20 02:22 UTC in 8.7s · 21 requests · 28 scripts · Detected: Next.js, Lovable, Bolt, Replit, Vercel

Top finding (free)

lowConfirmedwarnSecurity headers

Content-Security-Policy allows unsafe scripts

script-src permits 'unsafe-inline' which removes most XSS protection.

Confirmed from the HTTP response headers of the main document.

Locations

  • content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' https://c
Copy-paste fix prompt
Security fix for this Lovable project (React + Supabase).

Tighten my CSP script-src: remove 'unsafe-inline' and wildcard sources, and use per-request nonces or hashes for the inline scripts my framework requires.

Put any server-side logic in a Supabase Edge Function, store keys as Edge Function secrets, and show me the SQL migrations separately so I can review them before running.

10 more checks

lowConfirmedwarnSecurity headers
Details, location & fix prompt locked
criticalpassClient secrets
Details, location & fix prompt locked
criticalpassExposed artifacts
Details, location & fix prompt locked
highpassExposed artifacts
Details, location & fix prompt locked
highpassTransport
Details, location & fix prompt locked
mediumpassSecurity headers
Details, location & fix prompt locked
lowpassExposed artifacts
Details, location & fix prompt locked
lowpassSecurity headers
Details, location & fix prompt locked
lowpassSecurity headers
Details, location & fix prompt locked
highskippedSupabase / BaaS
Details, location & fix prompt locked

Heuristic match = a string in your public JavaScript/HTML looks like a secret (likely, not verified). Confirmed = directly observed in an HTTP response (e.g. a header is absent, a file's contents were validated). All checks are passive and read-only; secrets are stored redacted to their first 6 characters. A good grade is not a guarantee of security.