● Documentation
The docs. Pasteable.
Peer-level, no consultant-speak. Every page has a copy-pasteable command, a working example, and the why behind it.
▸ First 5 Minutes
4 stations- 01
LOCAL
Install nothing. Run anyway.
Point ShipSafe at any directory. Pattern checks come back in about 10 seconds.
First scanRUNnpx @ship-safe/cli scan . - 02
CI
Block bad PRs.
Drop the GitHub Action into your repo. Critical findings fail the check, the PR cannot merge.
GitHub Action - 03
CONTINUOUS
Catch what patterns miss.
Connect your dashboard. AI scans, scan diffs, plain-English fix prompts you paste into Cursor or Lovable.
Dashboard + AI - 04
FIX
Or let us send the fixes.
On a subscription, one click sends the fixes to your GitHub for you to approve, with a receipt of what was fixed and re-checked, what is still there, and what was not attempted.
Fix it for me
▸ Reference
13 pages- 01
Getting Started
Install ShipSafe, run your first scan, and connect to your dashboard.
- 02
Fix it for me, with a receipt
On a subscription, one click sends the fixes to your GitHub for you to approve, with a receipt of what was fixed and re-checked, what is still there, and what was not attempted.
- 03
CLI Reference
All commands, flags, and output formats for the ShipSafe CLI.
- 04
MCP Server
Let your AI coding agent scan the code it writes, in-loop. Works in Cursor, Claude Code, and Claude Desktop.
- 05
Remote MCP Server
Connect ShipSafe to Lovable, Base44, or any browser builder that supports remote MCP. One endpoint, a token, no install and no GitHub.
- 06
Live URL Scan
Scan your deployed app: runtime security headers plus secrets accidentally shipped to the browser in your client bundle.
- 07
Live App Probing (DAST)
Non-destructive dynamic checks against a running app: security headers, CSP, clickjacking, CORS, and exposed paths.
- 08
Git History Secrets
Find secrets that were committed and later deleted but still live in your repo's git history.
- 09
Configuration
Configure scan behavior with .shipsafe.yml and suppress rules with .shipsafeignore.
- 10
Security Rules
200+ documented rules, organized by category and severity.
- 11
GitHub Actions
Automate scans on every PR. Block merges on critical vulnerabilities.
- 12
GitHub App
Install it once. An independent, inline security review on every pull request, no CI setup.
- 13
Vulnerabilities by Platform
Common security issues in apps built with Lovable, Bolt, Cursor, v0, and Base44.