I built PathToShip because I kept seeing the same thing: apps built with Bolt, Lovable, Cursor, v0 or Replit that worked, and were not ready to run for real users.

The free scan is what it has been since June. Paste a GitHub URL, or connect a private repo through a GitHub App that gets read-only access to the repos you choose, and you get a 0–100 score across seven weighted dimensions: security, production readiness, architecture, scalability, infrastructure, code quality, cost efficiency. About 30 seconds, no signup. Every finding is shown with its file and line, nothing is held back. 80+ earns a Certified badge you can embed in a README, and the badge links to the live report so anyone can check it.

What's new is that it runs inside Claude. Connect it once from the directory, then in any chat: "Use PathToShip: is my app ready to launch? github.com/you/repo." When you have fixed something, "did my fix work?" re-checks only the findings you touched. It is read-only and you can watch it work on a public repo before you connect the one that matters. It is also in ChatGPT's plugin directory.

The data behind it, of the 1,867 public AI-built repos we scanned across nine tools:

- 30.7% clear the 80-point bar

- 27.1% carry at least one critical finding

- median score 72

Methodology and per-tool tables are on the blog. These are public repos we found, so they skew toward hobby projects. They are not a claim about all AI-built apps.

The follow-on post widens that to 3,911 repos and tries to break its own conclusions. Two thirds of the corpus is dormant, and the share with a critical finding climbs from 2.9% under 1,000 lines to 59.2% past 40,000, in all nine tools. Three tidier explanations did not survive: https://pathtoship.com/blog/when-ai-built-apps-actually-break

ASSESS is the $99 one-time unlock on the same permalink: your exit cost from the platform you built on and its reasoning, a migration playbook, an AI-written fix spec per finding, the report as PDF, a Production Readiness Review for the things a scanner cannot see (backups, monitoring, an incident plan), and a NotebookLM kit. The kit is the part people react to: drop it into NotebookLM and it produces a narrated explainer or a podcast about your app's actual findings.

The receipt: I ran the scanner on PathToShip itself. It scored 56. I bought my own report, spent a day fixing findings with an AI assistant following the playbook, and re-scanned at 97. Both permalinks are public and in the gallery.

The limitation you should know: the scanner over-flags. In July I audited our critical findings by hand and published a 42% false-positive rate. Earlier this month I hand-labelled 374 more findings, and the four most common false-positive classes were fixed the same week: test keys and placeholders reported as live secrets, keys attributed to the wrong provider, RLS warnings on databases that do not use RLS, and "no error handling" on handlers that cannot throw. I will publish the post-fix rate when it is measured, not before. A security scanner that hides real problems to look cleaner is worse than one that occasionally over-flags. If a finding on your report is wrong, tell me; disputes get fixed in public.

Background: 10+ years at AWS, former CIO, about 30 years running infrastructure. This is that checklist, automated.

I would like to hear what your report gets wrong, and which tool you built with.