Ten minutes to an AI that keeps scanning and fixing for youSay no more.

No, that is the whole point. Instead of leaving you with cryptic codes like CWE-319, ShipSafe explains every finding in plain English: what is wrong, why it matters, and exactly how to fix it. Your first scan and every paid plan also include a one-paste fix prompt written for your builder, Cursor or Lovable included. And if a finding still does not land, write to us at support@ship-safe.co. We would rather answer something obvious than leave you sitting there worrying about it.

No card, and nothing to install. Sign in, paste your repo or live URL, and that is the whole setup. You get real checks and a plain-English report free, with no trial timer and no expiry.

The free scan runs real pattern-based checks and shows you the actual findings, not a locked count. It catches the obvious things like exposed secrets and config issues. The paid AI audit adds the checks that patterns physically cannot do: authentication logic, Supabase RLS, IDOR, and business-logic flaws. A clean free scan is a good sign, not a guarantee, which is why the deeper checks exist.

Fair question to ask of any security tool. You see the actual findings on your own app for free, before you pay or enter a card. If it finds nothing, ShipSafe says so. Severity is not inflated, and every finding comes with the proof so you can verify it yourself. ShipSafe only makes point-in-time, evidence-based claims, never guarantees.

Your code is fetched, analyzed in memory, and deleted immediately after the report; ShipSafe does not store your source. Nothing is trained on your idea either: the AI analysis runs through Anthropic's Claude API, which does not train on the data sent to it under its commercial terms. The only thing we keep from your code is the security report, and deleting your account deletes every report with it.

ShipSafe writes the fix; you are the one who applies it. On Growth and Shield you get the exact prompt to paste back into whatever built your app, and for GitHub repos ShipSafe can open a pull request for you to review and merge. Then you re-scan, and ShipSafe independently re-verifies that the specific issue is actually closed. That is the point of an independent verifier: the tool that wrote the fix should not be the one that certifies it.

The badge is an evidence-based attestation that your app passed ShipSafe's checks as of a specific date, and it links to a public verification page anyone can check. It is not a guarantee or insurance. Because your app changes every time you re-prompt it, and because the world keeps moving even in the weeks you do not touch it, the badge self-expires and stays valid only while you keep re-verifying, on a 45-day rolling window. It is an honest, dated 'checked from the outside' signal, not a forever-safe stamp.

Those check one layer: Dependabot and Snyk check dependencies for known CVEs, and Supabase's advisor checks its own config. ShipSafe checks the app you actually shipped, end to end, and probes it live from the outside, proving leaked keys that still work, data readable with no login, and IDOR across two accounts, with the receipt. It is independent, tuned for the patterns Cursor, Lovable, and Bolt generate, and written for you rather than for a security team.

Use those, they help, but they are the platform grading its own homework, and they each have real limits. A builder's built-in scan is static and runs before you publish, so it never checks the app once it is live; an in-editor AI review typically looks only at the code you just changed, not the whole app you already shipped; and none of them reason about the running app the way an outsider can. The deeper point is independence: the same AI that wrote your code is not the right one to certify it, which is exactly why Lovable itself brought in an outside firm for its own security checks. ShipSafe is that outside check, across whatever mix of tools you built with, and it gives you a public verification page you can actually show a customer, not just a note in your editor.