ShipSafe

ShipSafe helps app builders inspect security problems in their code and deployed applications. Its dashboard produces findings with file and line references, then supplies proposed changes for the developer to approve. The publisher lists fix prompts for Cursor, Claude Code, Lovable and Bolt, alongside CLI, MCP and GitHub Actions workflows.

Scans during development and after deployment

You can point the CLI at a directory or file. It supports table, JSON and SARIF output, severity filtering, and CI exit codes that can fail a check when findings meet the chosen threshold. Login connects results to the dashboard; an ignore command suppresses an individual rule while retaining the suppressed finding there.

The ShipSafe documentation also describes live URL checks for runtime security headers and secrets accidentally shipped in browser bundles. Its dynamic app checks cover headers, CSP, clickjacking, CORS and exposed paths. Git-history scanning targets secrets that developers committed and subsequently deleted.

Proposed fixes still need your approval

On a subscription, ShipSafe can send fixes to GitHub for you to approve. Its receipt distinguishes changes that were fixed and rechecked from remaining issues and work it did not attempt. Developers can also paste fix prompts into their coding tools. The homepage says it rechecks internet-visible changes such as headers, CORS and cookie flags from outside the application.

That distinction matters when you assess a result: a proposed change, a confirmed external check and a clean scan describe different stages of the workflow. ShipSafe does not promise that an application is unhackable.

Scan depth and paid plans

Without a paid token, CI scans run pattern checks only. The CLI reference says the AI deep scan for problems requiring reasoning across files does not run in that case, and the CLI reports which scan depth actually ran.

The captured pricing section lists Solo at $19 per month for four deep scans and one watched project, without automatic rescans. Shield costs $29 per month for ten scans, two projects and rescanning every two weeks; Growth costs $49 for twenty scans, four projects and weekly rescanning. Shield and Growth add alerts, a verified badge and public proof page, while Growth includes a team workspace. A $9 one-time audit supplies one deep scan without ongoing project monitoring. Match the plan to the scan depth and recurrence you need, and review the actual findings before accepting fixes.