# ShipCheck

> ShipCheck (https://tryshipcheck.com) is a free launch-check scanner for vibe-coded apps built with Lovable, Cursor, Bolt, v0, Replit and similar AI tools. Paste a live URL or a public GitHub repo and get a 0–100 launch score plus a plain-English report with copy-paste fixes. Free during beta, no signup.

## What it checks
- Leaked API keys and secrets (OpenAI, Stripe, AWS, Supabase service_role, etc.) in HTML, shipped JavaScript and repo files; findings are masked
- Committed or publicly served .env files; env vars used in code but missing from .env.example
- HTTPS and security headers: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy
- Build hygiene for repos: build script, lockfile, package.json validity
- Broken links
- Mobile page speed (Google PageSpeed score)

Scans are passive and read-only. Nothing is stored. Score = 100 − 20 per critical − 5 per warning.

## How to use
- Web: open https://tryshipcheck.com/?scan=<url-or-github-repo> (e.g. https://tryshipcheck.com/?scan=https://example.com) to run a scan automatically
- API: `POST https://tryshipcheck.com/api/scan` with JSON body `{"target":"https://example.com"}` (or a GitHub repo URL). Returns JSON: ok, target, score, counts {critical,warn,ok}, findings [{severity, category, title, meaning, fix}], meta.
- Badge: `https://tryshipcheck.com/api/badge?url=<site>` returns an SVG "ShipCheck" score badge (cached ~1 day). Embed: `<a href="https://tryshipcheck.com/?scan=<site>"><img src="https://tryshipcheck.com/api/badge?url=<site>" alt="Checked by ShipCheck"></a>`

## Guides
- [Is my Lovable app secure?](https://tryshipcheck.com/guides/is-my-lovable-app-secure): How to check whether your Lovable app is secure: Supabase Row Level Security, exposed keys, security headers, auth and storage. A step-by-step checklist with fixes.
- [How to add security headers on Vercel](https://tryshipcheck.com/guides/add-security-headers-vercel): Copy-paste vercel.json to add CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy on Vercel, plus how to test them.
- [How to add security headers on Netlify](https://tryshipcheck.com/guides/add-security-headers-netlify): Add CSP, HSTS, X-Frame-Options and other security headers on Netlify using a _headers file or netlify.toml. Copy-paste examples, framework tips and testing.
- [The vibe-coded app launch checklist](https://tryshipcheck.com/guides/vibe-coded-app-launch-checklist): A practical pre-launch checklist for apps built with Lovable, Cursor, Bolt, v0 or Replit: security, secrets, database rules, performance, SEO, legal and monitoring.
- [Exposed .env file or API key? How to check and rotate](https://tryshipcheck.com/guides/exposed-env-file-api-keys): How to find leaked API keys and committed .env files in your repo, JavaScript bundle or live site, rotate them safely, and stop it happening again.
- [How to fix slow LCP in a vibe-coded app](https://tryshipcheck.com/guides/fix-slow-lcp-vibe-coded-app): Largest Contentful Paint over 2.5s? Practical fixes for Lovable, Bolt, v0 and Cursor apps: hero images, fonts, client-side rendering, JS bundles and caching.

## Contact
- hello@tryshipcheck.com