Launch preflight for AI-built apps

Built it with AI? Check it before you ship it.

Paste your app's address. Shipmark reads the live site the way a browser does and hands back a report in plain English: what is broken, what is exposed, and how to fix each item in the tool you built with.

The free check gives you a score, a count of problems by type, and your single worst finding. The checks are passive reads of your public site. Shipmark never asks for your password and never stores keys it finds. The email is stored with your run so your report link can be sent to you and followed up on.

What it checks

Two lists. Both checked on every run.

Security

  • Exposed keys. Secret keys and passwords sitting in public page code.
  • Open database. A Supabase database that answers to anyone who asks.
  • Open private files. .env files, .git folders, backups, and config files anyone can download.
  • Security headers. The short browser instructions that block common tricks.
  • HTTPS gaps. No redirect to the secure version, or secure pages loading files over an open connection.
  • Loud error pages. Errors that print file paths and software versions.

Launch readiness

  • Domain and SSL. The address resolves, www and the bare domain agree, and the certificate is valid and not about to lapse.
  • Placeholder text. Lorem ipsum, coming soon notes, TODO lines, and default page titles still live.
  • Search and share basics. Page title, description, share image, and favicon.
  • Broken links. Links on your site that land on error pages.
  • Key pages. Signup, contact, and checkout pages that return errors.
  • Test addresses. Localhost or staging addresses left in the live code.
  • Search files. robots.txt and sitemap present, and not blocking Google by accident.

How to read the report

  • Score. Starts at 100. Critical problems take 25, high 15, medium 8, low 3.
  • Each finding says what we found, what it means for you, and the fix.
  • Fixes are written for your tool. Pick Lovable, Bolt, Replit, or v0 and the steps match its screens.
  • Not checked means not checked. If a check could not run, the report says so and says why. Nothing is guessed.

Sample report

A real scan, run on a test page we built to fail.

This is the full output of the Shipmark scanner on a page with planted problems: a fake secret key, placeholder text, a localhost script, and an open .env file. Sample. Not a customer's site.

Loading the sample report...

Pricing

Pay once. No plan, no subscription.

Free quick check

$0

Your score, a count of problems by type, and your single worst finding.

Run the free check

Full report

$19

One time, per app

Every finding, each with what it means and a fix written for the tool you built with.

Get the full report

Three-report pack

$29

One time, three reports

Check the app, fix what the report found, then check it again. Built for launch week.

Get the three-pack

FAQ

Plain answers.

What does Shipmark do to my site?

It reads your public pages the way a browser does. It asks for a short, fixed list of file addresses that should never be public, reads your page code for keys that should never be public, and follows your own links to see which ones land on errors. It does not log in, it does not send forms, and it does not try passwords.

Is the Supabase check safe?

Yes. If your page code shows a Supabase address and its public anon key (the key every visitor already has), Shipmark makes one read-only request with that key. If a table answers with data, the report tells you which table and how to lock it. If the table is locked, nothing comes back and nothing is reported.

Do you keep my data or my keys?

No. Reports hold findings, not secrets. A key found in public code is shown cut down to its first few characters, so you can spot which key it is. The full value is never stored.

Can I check a site that is not mine?

Shipmark is built to check your own app before launch. The checks are the same reads any browser makes, but the report is written for the person who owns the site and can fix it.

Why pay $19 when the free check exists?

The free check tells you the size of the problem: a score, the counts, and the worst item. The full report is the fix list: every finding, what it means, and steps written for your tool. The three-pack adds the re-check after you fix things.

What if a check could not run?

The report lists it under Not Checked, with the reason. A check that did not run never turns into a finding, and it never turns into a pass either.

What is your refund policy?

If the report did not run or did not arrive, write to support and we will refund it. Refunds are handled by a person, and answered from your report first.