# ShipSafeStack

> A neutral directory of security scanners, databases, auth, payments, email, hosting, and AI app builders for people taking a vibe-coded app to production.

ShipSafeStack is a neutral, sponsorship-funded directory. Editorial listings are not paid rankings. Sponsored units are labeled. Pricing on tool pages is as seen on the checked date, or “See site” when a number was not confirmed. Checklists are practical notes, not security guarantees.

## Pages
- [Home](https://shipsafestack.com/): directory, new this week, a labeled Sponsored slot, and a newsletter signup
- [How we review](https://shipsafestack.com/how-we-review): neutrality and FTC labeling
- [Submit a tool](https://shipsafestack.com/submit): suggest a tool by email, listing is free
- [Sponsor](https://shipsafestack.com/sponsor): pinned listing $49 for 30 days, book by email
- [About](https://shipsafestack.com/about)
- [Privacy](https://shipsafestack.com/privacy)
- [Terms](https://shipsafestack.com/terms)
- [RSS](https://shipsafestack.com/feed.xml)

## Categories
- [Security scanners](https://shipsafestack.com/category/security-scanners): Point something at the live URL or the repo before you invite users.
- [Code & dependency security](https://shipsafestack.com/category/code-security): Static analysis, dependency risk, and secrets in the repository.
- [Database & auth](https://shipsafestack.com/category/database-auth): Where the data lives, and who is allowed to read it.
- [Payments](https://shipsafestack.com/category/payments): Checkout, subscriptions, and who is the merchant of record.
- [Email](https://shipsafestack.com/category/email): Transactional mail and product email that does not live in the browser.
- [Hosting & deploy](https://shipsafestack.com/category/hosting): Where the preview becomes a URL with HTTPS.
- [Monitoring & analytics](https://shipsafestack.com/category/monitoring): Know when production breaks, and what people actually do.
- [Automation](https://shipsafestack.com/category/automation): Background work that should not run inside a button click.
- [AI app builders](https://shipsafestack.com/category/ai-builders): The tools that generated the first version.

## Tools
- [Aikido](https://shipsafestack.com/tools/aikido): Security platform that looks across code, cloud, and runtime and tries to open fixes, aimed at teams that do not want five separate scanners. Official: https://www.aikido.dev/
- [AmIHackable](https://shipsafestack.com/tools/amihackable): Paste a public URL and get an outside-in report on exposed files, secrets in JavaScript, headers, TLS, and similar issues, plus a prompt for your AI tool. Official: https://amihackable.dev/
- [Better Auth](https://shipsafestack.com/tools/better-auth): Open-source TypeScript authentication library that lives in your app, with plugins for sessions, social login, and organizations. Official: https://www.better-auth.com/
- [Bolt.new](https://shipsafestack.com/tools/bolt): Browser-based AI builder for websites and apps, with Bolt Cloud for hosting, databases, authentication, and integrations. Official: https://bolt.new/
- [CheckVibe](https://shipsafestack.com/tools/checkvibe): Scans a live app and, if you connect them, the repo and pull requests, then returns ranked findings with a suggested fix. Official: https://checkvibe.dev/
- [Claude Code](https://shipsafestack.com/tools/claude-code): Anthropic’s coding agent for the terminal, IDE, and web, which reads and changes a repository and can open pull requests. Official: https://claude.com/product/claude-code
- [Clerk](https://shipsafestack.com/tools/clerk): Hosted authentication and user management with prebuilt sign-in UI, billed on monthly retained users rather than raw signups. Official: https://clerk.com/
- [Cloudflare](https://shipsafestack.com/tools/cloudflare): Global network for DNS, CDN, and application hosting, including Workers and Pages, with a free tier for hobby projects. Official: https://www.cloudflare.com/
- [CodeSonar](https://shipsafestack.com/tools/codesonar): Deep static analysis for C, C++, and other languages, sold for enterprise and safety-critical software. Now offered by AdaCore. Official: https://www.adacore.com/codesonar
- [Convex](https://shipsafestack.com/tools/convex): Backend building blocks in TypeScript — queries, mutations, and a reactive database — aimed at apps and agents that should stay in sync. Official: https://www.convex.dev/
- [Cursor](https://shipsafestack.com/tools/cursor): AI coding agent in a desktop editor, the terminal, and other surfaces, for working inside a real codebase. Official: https://cursor.com/
- [Firebase](https://shipsafestack.com/tools/firebase): Google's app platform for auth, databases, storage, hosting, and related services used to build and run web and mobile apps. Official: https://firebase.google.com/
- [GitHub Advanced Security](https://shipsafestack.com/tools/github-advanced-security): GitHub’s own code scanning, secret scanning, and dependency features for repositories hosted on GitHub. Official: https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
- [Inngest](https://shipsafestack.com/tools/inngest): Durable functions for background jobs and workflows: steps, retries, and events without operating your own queue. Official: https://www.inngest.com/
- [LockedVibe](https://shipsafestack.com/tools/lockedvibe): Security review for AI-built web apps covering secrets, Supabase or Firebase policies, auth, and dependencies, plus a free passive leak checker. Official: https://lockedvibe.com/
- [Loops](https://shipsafestack.com/tools/loops): Email platform for SaaS teams that sends marketing, product, and transactional lifecycle mail from one place. Official: https://loops.so/
- [Lovable](https://shipsafestack.com/tools/lovable): AI app builder that turns a description into a working product, and says it can host, authenticate, and take payments for what it creates. Official: https://lovable.dev/
- [n8n](https://shipsafestack.com/tools/n8n): Workflow automation you can self-host or run in their cloud, combining a visual canvas with code steps and hundreds of integrations. Official: https://n8n.io/
- [Neon](https://shipsafestack.com/tools/neon): Serverless Postgres with branching, plus auth, object storage, and functions. Neon is part of Databricks. Official: https://neon.com/
- [Netlify](https://shipsafestack.com/tools/netlify): Platform to build and deploy web apps from git, a CLI, or a prompt, with preview URLs, functions, and edge hosting. Official: https://www.netlify.com/
- [OWASP ZAP](https://shipsafestack.com/tools/owasp-zap): Free, open-source web application security scanner and proxy for testing a running site, including scripted scans. Official: https://www.zaproxy.org/
- [Paddle](https://shipsafestack.com/tools/paddle): Merchant of record for software and digital products. Paddle handles payments, sales tax, and compliance across markets. Official: https://www.paddle.com/
- [Plausible](https://shipsafestack.com/tools/plausible): Lightweight, cookie-free web analytics hosted in the EU, positioned as a simpler alternative to Google Analytics. Official: https://plausible.io/
- [Polar](https://shipsafestack.com/tools/polar): Merchant of record and usage billing for software, with subscriptions, credits, and metered events. Official: https://polar.sh/
- [PostHog](https://shipsafestack.com/tools/posthog): Product analytics, session replay, feature flags, and error tracking, with usage-based pricing and a large free tier. Official: https://posthog.com/
- [Replit](https://shipsafestack.com/tools/replit): Online environment where an AI agent builds and publishes apps, with built-in auth, database, hosting, and monitoring. Official: https://replit.com/
- [Resend](https://shipsafestack.com/tools/resend): API for transactional and marketing email, with official SDKs and React Email templates. Official: https://resend.com/
- [Scanbee](https://shipsafestack.com/tools/scanbee): Runs several scan types — live app, code, dependencies, and cloud checks — from one dashboard aimed at people building with Lovable, Bolt, and similar tools. Official: https://scanbee.dev/
- [Semgrep](https://shipsafestack.com/tools/semgrep): App security platform that combines custom and built-in rules for SAST, dependencies, secrets, and supply-chain checks in CI and the editor. Official: https://semgrep.dev/
- [Sentry](https://shipsafestack.com/tools/sentry): Error and performance monitoring for applications, with SDKs that report exceptions and traces from production. Official: https://sentry.io/
- [Snyk](https://shipsafestack.com/tools/snyk): Security platform for the code AI writes, open-source dependencies, containers, and cloud configuration, with hooks into coding agents. Official: https://snyk.io/
- [Socket](https://shipsafestack.com/tools/socket): Scans open-source packages for malicious behavior and blocks risky dependencies before they are installed or merged. Official: https://socket.dev/
- [Stripe](https://shipsafestack.com/tools/stripe): Payments and billing infrastructure for cards, checkout, and subscriptions. You are typically the merchant. Official: https://stripe.com/
- [Supabase](https://shipsafestack.com/tools/supabase): Postgres database with authentication, file storage, realtime, and edge functions, often the default backend under an AI-built app. Official: https://supabase.com/
- [v0](https://shipsafestack.com/tools/v0): Vercel’s AI builder for UI and full-stack features, with one-click deploy onto Vercel infrastructure. Official: https://v0.app/
- [Vercel](https://shipsafestack.com/tools/vercel): Hosting platform for web apps and agents, with preview URLs, serverless functions, and a tight path from v0 and Next.js. Official: https://vercel.com/
- [Vibe App Scanner](https://shipsafestack.com/tools/vibe-app-scanner): Scans a running AI-generated web app for leaked secrets, weak data access, auth gaps, and related issues, with a fix you can paste back into the builder. Official: https://vibeappscanner.com/
- [VibeCheck](https://shipsafestack.com/tools/vibecheck): Reads a public GitHub repo and returns a preliminary score for leaked keys, open database rules, and unprotected routes. Official: https://getvibecheck.dev/
- [VibeEval](https://shipsafestack.com/tools/vibe-eval): Black-box tests a deployed app from the outside, then has a person review findings before the report is delivered. Official: https://vibe-eval.com/
- [VibeWrench](https://shipsafestack.com/tools/vibewrench): Runs free checks for security, speed, SEO, and accessibility against a URL, a public GitHub repo, or pasted code, and returns a fix prompt per finding. Official: https://vibewrench.dev/
- [Windsurf](https://shipsafestack.com/tools/windsurf): AI code editor with the Cascade agent and cloud agents, for working in a local codebase and delegating longer tasks. Official: https://windsurf.com/
- [Xano](https://shipsafestack.com/tools/xano): Backend platform for building and running APIs, data, and business logic, including with coding agents, on a stack you can govern. Official: https://www.xano.com/

## Guides
- [API keys leaking into the frontend](https://shipsafestack.com/guides/api-keys-in-the-frontend): How to tell a publishable key from a secret, and how to check the JavaScript bundle of an AI-built app before you ship it.
- [Pre-launch security checklist for vibe-coded apps](https://shipsafestack.com/guides/pre-launch-security-checklist): A practical pass over secrets, database rules, auth, payments, and abuse before you share the URL of an app built with Lovable, Bolt, Cursor, or a similar tool.
- [Rate limiting checklist](https://shipsafestack.com/guides/rate-limiting): Where an AI-built app usually needs a limit, and what to verify so the limit is on the server rather than on a disabled button.
- [Stripe webhook verification checklist](https://shipsafestack.com/guides/stripe-webhook-verification): What to confirm so a Stripe payment is recorded from Stripe’s signed event, not from a success page the browser can fake.
- [Supabase row-level security checklist](https://shipsafestack.com/guides/supabase-row-level-security): What to verify on Supabase before a Lovable, Bolt, or other client is allowed to talk to the database with the anon key.

## Comparisons
- [Clerk vs Supabase Auth](https://shipsafestack.com/compare/clerk-vs-supabase-auth): Hosted sign-in UI and retained-user billing versus authentication that ships inside the Supabase project.
- [Stripe vs Paddle](https://shipsafestack.com/compare/stripe-vs-paddle): You are the merchant with Stripe, or Paddle is the merchant of record and handles sales tax for a digital product.
- [Supabase vs Firebase](https://shipsafestack.com/compare/supabase-vs-firebase): Postgres and row-level security versus Google's document database and security rules, for apps that started in an AI builder.

## Ship guides
- [Ship a Bolt app](https://shipsafestack.com/builders/bolt): A launch checklist for a Bolt.new project, including Bolt Cloud and projects that connect their own database.
- [Ship a Claude Code app](https://shipsafestack.com/builders/claude-code): A review list for a repo changed by Claude Code, including the credentials the agent could see.
- [Ship a Cursor app](https://shipsafestack.com/builders/cursor): How to review a repository an agent edited in Cursor before you deploy it.
- [Ship a Lovable app](https://shipsafestack.com/builders/lovable): What to check before a Lovable project goes from a shared preview to something with real users and real data.
- [Ship a Replit app](https://shipsafestack.com/builders/replit): What to verify when Replit Agent publishes an app that already includes hosting, data, and auth.
- [Ship a v0 app](https://shipsafestack.com/builders/v0): A short launch pass for a v0 project that deploys to Vercel.
- [Ship a Windsurf app](https://shipsafestack.com/builders/windsurf): What to check after Cascade or a Windsurf cloud agent edits a repository.