Ship fastShip safe.

No, that is the whole point. Instead of cryptic codes like CWE-319, ShipSafe explains every finding in plain English: what is wrong, why it matters, and exactly how to fix it. Reports include copy-paste fix prompts you can drop straight into Cursor or Lovable.

No. The free scan needs zero payment info, just sign in and paste your repo or live URL. You get real checks and a plain-English report free, with no trial timer and no expiry.

The free scan runs real pattern-based checks and shows you the actual findings, not a locked count. It catches the obvious things like exposed secrets and config issues. The paid AI audit adds the checks that patterns physically cannot do: authentication logic, Supabase RLS, IDOR, and business-logic flaws. A clean free scan is a good sign, not a guarantee, which is why the deeper checks exist.

Fair question to ask of any security tool. You see the actual findings on your own app for free, before you pay or enter a card. If it finds nothing, ShipSafe says so. Severity is not inflated, and every finding comes with the proof so you can verify it yourself. ShipSafe only makes point-in-time, evidence-based claims, never guarantees.

Your code is fetched, analyzed in memory, and deleted immediately after the report; ShipSafe does not store your source. The AI analysis runs through Anthropic's Claude API, which does not train on the data sent to it. The only thing kept is the security report itself, and you can delete it.

ShipSafe gives you the exact fix to paste back into your builder, and on paid plans it can open a pull request with the fix. Then you re-scan, and ShipSafe independently re-verifies that the specific issue is actually closed. That is the point of an independent verifier: the tool that wrote the fix should not be the one that certifies it.

The badge is an evidence-based attestation that your app passed ShipSafe's checks as of a specific date, and it links to a public verification page anyone can check. It is not a guarantee or insurance. Because your app changes every time you re-prompt it, the badge self-expires and stays valid only while you keep re-verifying, on a 45-day rolling window. It is an honest, dated 'checked from the outside' signal, not a forever-safe stamp.

Those check one layer: Dependabot and Snyk check dependencies for known CVEs, and Supabase's advisor checks its own config. ShipSafe checks the app you actually shipped, end to end, and probes it live from the outside, proving leaked keys that still work, data readable with no login, and IDOR across two accounts, with the receipt. It is independent and tuned for the patterns Cursor, Lovable, and Bolt generate.

Use those, they help, but they are the platform grading its own homework, and they each have real limits. A builder's built-in scan is static and runs before you publish, so it never checks the app once it is live; an in-editor AI review typically looks only at the code you just changed, not the whole app you already shipped; and none of them reason about the running app the way an outsider can. The deeper point is independence: the same AI that wrote your code is not the right one to certify it, which is exactly why Lovable itself brought in an outside firm for its own security checks. ShipSafe is that outside check, across whatever mix of tools you built with, and it gives you a public verification page you can actually show a customer, not just a note in your editor.