Hey Product Hunt! 👋 I’m Bastav, maker of Shipcheck. Over the past few months, tools like Cursor, Claude Code, v0, Bolt, and Lovable have changed how software is built. "Vibe coding" lets anyone go from idea to deployed app in an afternoon. But there's a catch: AI coding agents write code that works, not code that is secure. We repeatedly saw the exact same vulnerabilities in freshly shipped AI apps: 1. API keys baked into client-side bundles (`VITE_` / `NEXT_PUBLIC_`) 2. Open Firestore and Supabase RLS rules (`allow read, write: if true;`) 3. Unprotected backend LLM routes that anyone can loop to drain your API credits 4. Missing security headers, exposed `.env` files, and public `.map` source maps I built Shipcheck to serve as a 5-second pre-flight check before you share your project with the world. 🛡️ How it works: - No signup, no tracking: Paste a public GitHub repo or any live website URL. Zero persistent storage. - 34 specialized rules: Covers both static source ASTs and production JavaScript bundles. - Strict redaction: Discovered secrets are masked (`AIza••••4f2c`) before touching logs or LLMs. - One-click Agent Fixes: Click "Copy for AI Coding Agent" to generate a clean markdown prompt formatted specifically for Claude Code, Cursor, or ChatGPT to autofix the issues in seconds. Shipcheck is completely free to use. I'd love to hear your thoughts, feedback, or any specific security checks you'd like added to our rule engine! 🚀

Shipcheck

Pre-flight security scanner for vibe-coded apps

Pre-flight security scanner for vibe-coded apps