Security scanners
ShipWatch
Reads a live public app for leaked API keys, a downloadable .env or .git path, and missing security headers, and writes a fix prompt for an AI builder.
Pricing as seen
Free scan listed at $0, one-off, no sign-up. A plan unlocks every fix prompt and weekly monitoring. Paid price: See site.
Checked 29 Oct 2026. Prices change. Confirm on the vendor site before you buy.
Pricing sourceUpdated
29 Oct 2026
Added
29 Oct 2026
Supported builders
The homepage names Lovable, Bolt, v0, Replit, and Cursor, and says any publicly reachable web app qualifies, including sites on Vercel or Netlify and custom domains. It does not ask for the repository.
What it is
ShipWatch's homepage says it fetches the page and its JavaScript the way a stranger would. It lists leaked keys, including Stripe, OpenAI, Anthropic, AWS, and a Supabase service_role key, plus whether /.env or /.git/HEAD can be downloaded. It also checks HTTPS, HSTS, Content-Security-Policy, framing, and X-Content-Type-Options. Each issue comes with a prompt to paste into Lovable, Cursor, or Bolt. If the app uses Supabase, the site says it flags that and offers a prompt to review row level security, and that it does not query the database.
The free scan is listed at $0, one-off, with no sign-up. The homepage says that scan shows every issue found and the full fix for the most serious one. A plan unlocks every fix prompt and a weekly rescan, after you prove ownership with a DNS TXT record or a meta tag. Free scan results are not stored. The site says the requests are read-only: no login, no form submission, and no exploit attempt, and that you should only scan apps you own or have permission to test.
Best for: A public URL, including a Lovable, Bolt, v0, Replit, or Cursor app, when you want an outside read of keys, files, and headers.
Watch-outs
- The homepage says it does not test database rules, auth logic, or server code.
- The free scan includes the full fix for the top issue only. Every fix prompt and weekly monitoring are on a plan.
- Weekly scans run only after you prove you own the app with a DNS TXT record or a meta tag.
Our take
Opinion from ShipSafeStack. Not a score, not a certification, and not a sponsorship.
ShipWatch states that a clean report does not mean the app cannot be hacked. It says the check does not test database rules, auth logic, or server code, and that it only reads what is already public.