Tuned for the code your builder writes
1,347 checks·updated weekly
Both of yours are one click. We handle the middle.
We don’t host your code. We don’t keep your ideas. We don’t train anything on your creativity. We do the work — and then we do it again next week.
Shield
$29/mo
Growth
$49/mo
Every plan reaches the same people. Shield gets answered first.
Every plan is the same product. They differ in four things: how many deep scans you get, how many projects we watch, how often we re-scan them, and how quickly we answer you. Every plan includes:
Prices include VAT and sales tax where they apply — what you see is what you pay. Buying for a company? Add your VAT number at checkout for a business invoice.
Just want one look? — $9, once
One deep scan and every finding it turns up. No plan, nothing renews, and we do not watch the project afterwards.
Not magic, and we’d rather tell you exactly how it works than let you imagine something we don’t do.
For most things we find, we write the exact change and show you what it does in one sentence. You paste it in, and for anything visible from the internet — headers, CORS, cookie flags — we check it again from outside to prove it actually closed. Prefer to do it yourself? Copy it straight into Cursor.
Selling to people in Europe means one set of rules. Taking card payments means another. Tell us where you are and we show you which of them a finding actually touches — instead of handing you a list of regulations you’ll never need.
Your app doesn’t change, but the world does. New ways in get published every week, and something that was fine on Monday can be a problem by Friday. That’s why the badge expires — so when it’s showing, it means recently, not once, a while ago.
No mystery box. Here’s the whole thing, timed.
A GitHub address or your live site. Nothing to install, nothing to configure, no access to anything you didn’t hand us.
Which pages exist, where the doors are, what talks to your database, what’s exposed to the open internet.
You don’t wait for the end. Results land as we find them, already written in plain English.
For each thing we found, the exact change — and one sentence on what it does. Approve it, or paste it yourself.
What stays is the finding, the report and your badge. Deleting your account removes all of it.
Because the world changed even if your app didn’t. If something new turns up, it lands in your next report.
Typical timings on a small repo, not a guarantee — a large codebase takes longer.
All four of these are real options. Here’s where each one actually lands.
Ask the AI that built it
Free
A proper security tool
$300+/mo
Hire someone
$3k+/audit
ShipSafe
$9 once
Not a chatbot with a human name. If something’s gone wrong at 2am and you don’t know what you’re looking at, you send us the screenshot and someone who does this every day reads it with you. That’s included at every price, and it always will be.
We’d rather you asked us something obvious than sat there worrying about it.
We don’t keep your codebase.
We read it, check it, and drop the copy we were working from. What stays is the finding itself — the file, the line, and a few lines around it, so you can see what we meant. Delete your account and that goes too.
We don’t train on what you’re building.
Your idea isn’t training data — not for us, and not for the AI we call. What we do keep is your own calls: mark a finding a false positive and the assistant remembers, for your account only, so it doesn’t argue the same point twice. We also look at whether that rule was wrong — the rule, the file it fired on, and why you disagreed. Not your project.
We don’t promise you’re unhackable.
Nobody honest can. We tell you what we checked, what we found, and when — and the badge says so plainly.
We don’t make you learn our language.
If a result needs a glossary, we wrote it badly and we’ll fix it.
Load your app. We read it, and we write the fix for you to paste.
Better you find it than someone else.
Free to start. No card.
