Made your app with Lovable, Cursor or Bolt? SIGSHIP spots the mistakes hackers look for, explains them like a friend, and gives you a fix to paste back into your AI.17 deterministic checks for AI-generated code. Runs offline, zero deps, exit 0 only on GO — a real ‘definition of done’ for your coding agent.
No sign-up · Nothing uploaded · Your code never leaves your computer
Works with apps made in
56 seconds. The video player loads from Vimeo only when you press play.
Open your project folder and run one line. Nothing gets uploaded.npx sigship in the repo root. Reads files locally, about 33 ms on the demo app.
Each problem says what could happen and how bad it is.Findings sorted by severity with file:line and impact.
Copy the fix, paste it into Lovable or Cursor, check again until it says Ready.--prompt emits a fix brief. Loop until exit 0.
Hover a card to see the fix. No jargon — just what could happen and what to do.
Anyone who reads your code or your site’s JavaScript can copy it and spend your money.
Rotate the key, then move it to a server-side environment variable.
Your .env file is in the repo, so every password in it is public.
Remove .env from git, add it to .gitignore, and rotate every value.
A NEXT_PUBLIC_ or VITE_ name ships the secret to every visitor’s browser.
Drop the public prefix and move the call to a server route.
Strangers copy your key from the browser and use your OpenAI credits for free.
Call the AI from a server route that holds the key.
Anyone with your public key can read every row in this table.
Turn on row level security and add an owner-only policy.
The lock exists, but it’s set to “allow all”. Anyone can edit or delete.
Replace true with a real condition, like auth.uid() = user_id.
Someone sends a fake “payment succeeded” and gets paid features free.
Verify every Stripe event with its signing secret.
A crafted form entry becomes a database command.
Use a parameterised query. Never build SQL with template strings.
One script loops overnight and you wake up to a huge bill.
Add a per-user rate limit and a monthly spending cap.
Users flip one browser setting and become admin.
Store roles in the database and check them on the server.
A comment with a hidden script runs in every visitor’s browser.
Sanitise it with DOMPurify, or render it as plain text.
Other sites can talk to your app on your users’ behalf.
Replace the wildcard with your own domain.
Passwords end up in logs that more people can read than your database.
Log that it happened, never the value.
One bad record gives your users a blank white page.
Add an error boundary (error.tsx in Next.js) with a retry.
Your app breaks for a week before anyone tells you.
Add an error tracker such as Sentry on the client and the server.
A Friday fix breaks signup until Monday.
One test each for sign up, log in and pay, run on every pull request.
A package updates itself on deploy and your live app breaks.
Commit your lockfile.
const openai = new OpenAI({
apiKey: "sk-live-9fX…"
});Move the OpenAI call into a server function. Read the key from process.env.OPENAI_KEY.
// server only
const openai = new OpenAI({
apiKey: process.env.OPENAI_KEY
});Plug SIGSHIP into Claude Code, Cursor, Windsurf, Copilot or any tool that speaks MCP — the standard way AI tools connect to helpers. Your agent runs the check and keeps fixing until it's Ready.
claude mcp add sigship -- npx -y sigship mcp
{ "mcpServers": { "sigship": { "command": "npx", "args": ["-y", "sigship", "mcp"] } } }{ "mcpServers": { "sigship": { "command": "npx", "args": ["-y", "sigship", "mcp"] } } }{ "servers": { "sigship": { "command": "npx", "args": ["-y", "sigship", "mcp"] } } }gemini mcp add sigship npx -y sigship mcp
[mcp_servers.sigship] command = "npx" args = ["-y", "sigship", "mcp"]
npx sigship --prompt
Put a live SIGSHIP badge on your site. It tells visitors you take their data seriously — and it updates itself.
Shows you care. But it is your own word and anyone can paste it, so visitors give it less weight.
Business gives the same badge to every app your team ships.
Covers more of your app. Still your own word, so it stays bronze, below the metals SIGSHIP checks itself.
The first badge we stand behind. It cannot go stale or be copied, because we draw it.
Agency shows it on client apps as “via your studio”.
The streak grows every day you stay clean. Time is the proof nobody can fake. sigship.dev itself carries this badge: the check runs on every change to the site.
The answer to “did an expert actually look?” A person with a protocol, not only a scanner. Nobody holds this badge yet, including us.
A SIGSHIP expert engineer reviewed the code and SIGSHIP re-checks it every time the code changes. Any Team or Agency plan plus an expert review in the last 12 months. The black platinum finish is reserved for this, so it stays rare. Nobody holds it yet.
Badges are never sold on their own. Each one comes with the plan or review above it, and moves up when you do.
Connect your apps once. Every night we check them, show you a simple score, and ping you the moment something needs fixing.
SIGSHIP keeps growing. When a new attack shows up, we add a check for it — proactively, before it reaches you.
We watch security news, CVEs and attacks on apps like yours.
Our team turns it into a new check within days.
Your next check catches it — no action needed.
🧪 Testers & QA teams — tools for you are coming soon.
Like an app you install. Runs on your computer and in your own GitHub; your code never leaves.
The open source check for every AI-built app.
Open source under MIT. No account, no card, no limits.
Check my appEvery check we have, on your own machine and CI.
Includes 1 year of new checks. Keep it forever.
Join waitlistFor studios and agencies shipping client apps.
Includes 1 year of new checks. Keep it forever.
Join waitlistLike Gmail: we run it for you and watch your live apps every night. Every Cloud plan includes every Pro check.
For a founder with an app in production.
Yearly billing saves 20%. Cancel anytime. 14-day trial, no card. A feature that misses its date is refunded on request.
Buy SoloFor small teams shipping every week.
Yearly billing saves 20%. Cancel anytime. 14-day trial, no card. A feature that misses its date is refunded on request.
Buy TeamFor agencies running many client apps.
Yearly billing saves 20%. Cancel anytime. 14-day trial, no card. A feature that misses its date is refunded on request.
Buy AgencyAt launch: built and in use todayBy December: rolling out by December 2026By January: rolling out by January 2027By February: rolling out by February 2027A feature that misses its date is refunded on request.
Prices for paid plans are early estimates and may change before launch. See every plan →
One line. Free forever. Powered and backed by zoof04.