Paste your deployed URL. ShipReady loads the same HTML and JavaScript your visitors get and checks it for the mistakes that hurt AI-built apps: leaked keys, open Supabase tables, unprotected APIs and a missing share image.
Don't upload your code to a stranger's tool.
Your live site is already public, so we scan what it serves. You don't upload a zip or give us GitHub access.
Anyone can run the public scan on any URL. Sensitive results stay locked until you prove the site is yours.
Our servers fetch the public page directly. We never ask for code, repo access or passwords.
Public checks run right awayTitle, viewport, favicon, meta description, OG image, image alts, console.log / debugger in served JS.
Sensitive checks stay lockedStripe / OpenAI / Supabase secret keys in the client bundle, Supabase tables without row-level security, unprotected API routes.
Prove it's yours to unlockAdd one meta tag we generate, click verify, and only then do secret findings appear.
Blockers first. Every failure comes with a fix you can paste straight into Cursor, v0 or Lovable.
AI tools love putting sk_live_…, OpenAI keys and Supabase service_role keys in client code "just to make it work." Anyone can view-source and drain your account. We scan the JavaScript your site serves and only tell the verified owner what we find.
If row-level security is off, your anon key (which is public by design) lets anyone read or write your whole database. Same story for /api routes with no auth check. These two cause the worst leaks in AI-built apps.
No og:image means your big X / Product Hunt launch post renders as a grey box. No favicon, default "Vite App" title, and console.logs in production do the same damage, quieter. All checked from the live HTML, no verification needed.
Each guide answers one exact problem people search for, walks through the fix step by step, and ends with a free scan of your whole site, so fixing one issue doesn't leave four others hiding.
sk_live must never ship to the browser, and how to move it to a server route.
Link previews look broken on X →The 3 OG tags every launch needs, at the right size (1200×630).
OpenAI key in client bundle →How keys leak through NEXT_PUBLIC_ variables, and the proxy-route pattern that fixes it.
Anyone can call your /api route →Add an auth check in 6 lines before someone scripts your endpoint.
Shows for any URL: title & default-title check · viewport · meta description · favicon · OG title / description / image · Twitter card · image alt text · oversized / unlazy images (from markup) · console.log & debugger in served JS · HTTPS.
Only after ownership verification: OpenAI key in bundle · Stripe secret key in bundle · Supabase service_role key in bundle · Supabase RLS risk · unprotected API routes.
Every check and unlimited re-scans are free while ShipReady is in early access. Paid plans aren't available yet. Tap the one you'd buy so we know what to build.
Coming soon.
Every project you ship. Coming soon.
Free scan needs no card and no signup. Nothing to pay today.