What we check | Shipwardly

How findings are marked

Reports plot each finding with a hazard symbol from nautical charts. The dotted ring marks a danger to plan around.

Critical: Someone could misuse this now. Fix it today.
High: A real exposure. Fix it this week.
Medium: A weakness worth planning a fix for soon.
Low: A missing safety net. Tidy it up when you can.
Info: For your awareness. Not a problem on its own.

Passive checks: any site

These run on every free scan. They only use what a browser receives when it loads your homepage: the HTML, the JavaScript and CSS it links to, and the response headers.

Reference P1

HTTPS enforced

Every page is served over HTTPS, and plain HTTP addresses redirect to it.

Without it, anyone on the same public Wi-Fi could read or change what your customers send and receive.

Reference P2

TLS certificate

Your certificate is valid, matches your domain and does not expire within the next 14 days.

An expired certificate puts a full-page warning in front of every visitor, and most of them will leave.

Reference P3

Security headers

Content Security Policy, HSTS, X-Content-Type-Options, frame protection, Referrer-Policy and Permissions-Policy.

These tell browsers what to trust. They limit the damage if something else goes wrong, such as a script slipped in through a form.

Reference P4

Cookie flags

Whether your cookies are marked Secure, HttpOnly and SameSite.

They stop login sessions being read by scripts or sent along with requests from other sites.

Reference P5

Leaked secrets

Stripe secret keys, OpenAI and Anthropic keys, AWS keys, Supabase service role keys, private keys and other high-entropy secrets in your HTML and JavaScript.

Anyone can read your page source. A leaked key can mean refunds issued in your name, a large AI bill, or your whole database open to read.

Reference P6

Supabase project

Your app uses a Supabase project with its public anon key. Reported for information.

The anon key is meant to be public, so your data is protected only by row level security rules. We note it so you know those rules matter.

Reference P7

Firebase config

Your app includes a Firebase configuration. Reported for information.

The config is public by design. Your Firebase security rules are what keep your data private.

Reference P8

Source maps

Map files published alongside your JavaScript.

They give anyone a readable copy of your original source code, comments and internal names included.

Reference P9

Mixed content

Scripts, images or forms loaded over plain HTTP on a secure page.

Browsers block or warn about it, which can quietly break parts of your app, and insecure scripts can be tampered with on the way.

Reference P10

Platform detection

Signs that your app was built with Lovable, Bolt, Next.js or Vite. Reported for information.

It lets us write each fix for the way your app is actually built.

Verified checks: after you prove ownership

These look beyond the homepage, so we only run them once you have shown the domain is yours with a DNS TXT record or a file in /.well-known. A verified site can also have free weekly monitoring, if you turn it on: we run every check again each week and email you only when a new finding appears or one is fixed.

Reference V1

Sensitive files

Files such as /.env and /.git that can be downloaded from your site.

They often hold database passwords and API keys, or the complete history of your source code.

Reference V2

Directory listing

Folders that list their contents to anyone who asks.

They expose files you never meant to publish, such as backups and customer uploads.

Reference V3

CORS settings

Which other websites may call your API from a visitor's browser.

A setting that is too open can let another site act on your users' behalf.

Reference V4

Supabase row level security

Whether tables your site uses can be read without logging in. We ask only for a row count and never receive your data.

Missing rules are the most common way AI-built apps expose customer data.

Reference V5

Admin routes

Common admin addresses that answer without asking for a login. Reported for information unless there are clear signs of an open panel.

An unguarded admin panel can give a stranger control of your app.