ShipSniffer

ShipSniffer is a launch-readiness scanner for apps built with Lovable, Bolt, Replit, v0, Cursor and friends. Paste your URL and get a 0-100 ship score in about a minute, with no signup.

What the free URL scan checks

• Leaked secrets in your HTML and JS bundles (OpenAI, Anthropic, Stripe live keys, AWS, GitHub, Supabase service_role and more)

• Security headers (CSP, HSTS, frame protection, nosniff, referrer policy) and HTTPS redirects

• SEO and launch blockers: title, meta description, Open Graph/Twitter cards, favicon, robots.txt, sitemap, viewport, broken links

Deep Firebase/Supabase checks

If your app ships a Firebase or Supabase config, ShipSniffer can test whether your data is readable without logging in. These active checks run only after you verify you own the domain (meta tag, .well-known file or DNS TXT record).

Premium source scan

Point it at a public GitHub/GitLab repo or upload a .zip to find committed .env files, hardcoded secrets, open Firebase rules, SQL tables without Row Level Security, SQLi/eval/XSS patterns, open CORS, unprotected routes and vulnerable npm packages. Uploaded code is scanned in a temp folder and deleted right after.

Fix it, don't just find it

Every finding comes with a copy-paste prompt for Cursor (or any AI coding tool) that tells it exactly what to change.

Pricing

The free scan shows your most serious issue in full. $12 one-time unlocks the full report with every finding and fix prompt. No subscription.