Run one command in your app's folder and see, file by file and line by line, the gaps that expose data or money.

Ship Check Scanner runs 17 checks on apps built with Lovable, Bolt, Replit, v0 or Base44: secret keys in the browser bundle or git history, the Supabase service role in browser code, tables without Row-Level Security, policies that open every row, public storage buckets, unsigned Stripe webhooks, success pages that grant the plan, and AI routes anyone can call.

Every finding comes with its file and line, red or amber, one line on why it matters, and the page of the free Ship Check List that walks through the fix.

One file, no dependencies, Node 18 or later. It runs on your machine, never uploads your code and always masks keys. Add --ci to fail a build on red findings.

These are heuristics, not proof: a clean run is not a guarantee.