---
title: "Documentation | ShipSafe"
description: "Install ShipSafe, run security scans, configure rules, and wire it into CI."
doc_version: 2026-09-21
last_updated: 2026-09-21T04:54:37.688Z
canonical: https://ship-safe.co/docs
---

# Documentation | ShipSafe

● Documentation

# The docs. Pasteable.

Peer-level, no consultant-speak. Every page has a copy-pasteable command, a working example, and the why behind it.

![](https://ship-safe.co/_next/image?url=%2Fmascot%2Fbosun-laptop-watch.jpg&w=640&q=75&dpl=dpl_9WRuBGVFrmtjyKjqNw2VCigDq9zK)

## ▸ First 5 Minutes

4 stations

1. 01  
LOCAL  
### Install nothing. Run anyway.  
Point ShipSafe at any directory. Pattern checks come back in about 10 seconds.  
RUN  
Copy  
```bash  
npx @ship-safe/cli scan .  
```  
[First scan](https://ship-safe.co/docs/getting-started)
2. 02  
CI  
### Block bad PRs.  
Drop the GitHub Action into your repo. Critical findings fail the check, the PR cannot merge.  
[GitHub Action](https://ship-safe.co/docs/github-actions)
3. 03  
CONTINUOUS  
### Catch what patterns miss.  
Connect your dashboard. AI scans, scan diffs, plain-English fix prompts you paste into Cursor or Lovable.  
[Dashboard + AI](https://ship-safe.co/docs/cli)
4. 04  
FIX  
### Or let us send the fixes.  
On a subscription, one click sends the fixes to your GitHub for you to approve, with a receipt of what was fixed and re-checked, what is still there, and what was not attempted.  
[Fix it for me](https://ship-safe.co/docs/fix-it-for-me)

## ▸ Reference

13 pages

- [01Getting StartedInstall ShipSafe, run your first scan, and connect to your dashboard.](https://ship-safe.co/docs/getting-started)
- [02Fix it for me, with a receiptOn a subscription, one click sends the fixes to your GitHub for you to approve, with a receipt of what was fixed and re-checked, what is still there, and what was not attempted.](https://ship-safe.co/docs/fix-it-for-me)
- [03CLI ReferenceAll commands, flags, and output formats for the ShipSafe CLI.](https://ship-safe.co/docs/cli)
- [04MCP ServerLet your AI coding agent scan the code it writes, in-loop. Works in Cursor, Claude Code, and Claude Desktop.](https://ship-safe.co/docs/mcp)
- [05Remote MCP ServerConnect ShipSafe to Lovable, Base44, or any browser builder that supports remote MCP. One endpoint, a token, no install and no GitHub.](https://ship-safe.co/docs/remote-mcp)
- [06Live URL ScanScan your deployed app: runtime security headers plus secrets accidentally shipped to the browser in your client bundle.](https://ship-safe.co/docs/live-url-scanning)
- [07Live App Probing (DAST)Non-destructive dynamic checks against a running app: security headers, CSP, clickjacking, CORS, and exposed paths.](https://ship-safe.co/docs/dast-scanning)
- [08Git History SecretsFind secrets that were committed and later deleted but still live in your repo's git history.](https://ship-safe.co/docs/git-history-scanning)
- [09ConfigurationConfigure scan behavior with .shipsafe.yml and suppress rules with .shipsafeignore.](https://ship-safe.co/docs/configuration)
- [10Security Rules200+ documented rules, organized by category and severity.](https://ship-safe.co/docs/rules)
- [11GitHub ActionsAutomate scans on every PR. Block merges on critical vulnerabilities.](https://ship-safe.co/docs/github-actions)
- [12GitHub AppInstall it once. An independent, inline security review on every pull request, no CI setup.](https://ship-safe.co/docs/github-app)
- [13Vulnerabilities by PlatformCommon security issues in apps built with Lovable, Bolt, Cursor, v0, and Base44.](https://ship-safe.co/docs/vulnerabilities-by-platform)

## Sitemap

Every page of this site, in markdown: [https://ship-safe.co/sitemap.md](https://ship-safe.co/sitemap.md)