Security and privacy

Exactly what a checkup does.

ShipCheck behaves like a careful visitor. It reads public pages and makes the same read-only requests a browser could make with keys the site already ships.

What we check

• Public HTML and same-origin JavaScript, looking for known secret formats. The full secret is not stored.
• One-row reads of common Supabase or Firebase tables using only the public key already in the app. Row contents are discarded.
• A list of Supabase storage buckets with that same public key. Files inside the buckets are not downloaded.
• Common admin and debug URLs, fetched once each.
• Security headers, HTTPS, mixed content, CORS, .env, .git, and source maps.
• A real browser run for console errors, failed requests, and screenshots, when Chromium or a remote browser is configured.
• A launch checklist, and Core Web Vitals from PageSpeed Insights when that API answers.
• Fingerprints of a few known-outdated libraries, and hints about email confirmation and rate-limit headers.

What we never do

• No password guessing, fuzzing, or exploit payloads.
• No writes to your database, storage, or auth users.
• No brute force against login, and no repeated requests meant to trip a rate limit.
• No storing of database rows or full secret values.
• No full finding details until you prove you control the domain.
• No scanning of private network addresses from production.

Responsible disclosure

Email security@example.com if you find a problem in ShipCheck itself. Please give us a chance to fix it before you publish details. Do not access other customers’ data. This address is a placeholder until the owner sets DISCLOSURE_EMAIL.

Account data, the email log, and how long we keep a checkup are described on the privacy page. Only scan a site you own or are allowed to test. That rule is also in the terms.