Skip to main content
Shipwardly
Log in

How a Shipwardly survey works

We start with what any browser can see, explain it plainly, and only look deeper once you have shown us the site is yours. Here is each stage, in order.

The stages of a survey

  1. Stage 1: The passive scan

    You give us a web address. We fetch the page exactly as a visitor's browser would, and nothing more.

    • We read your homepage HTML, the JavaScript and CSS files it links to, and the response headers your server sends.
    • We do not probe other paths, log in, submit forms or guess at hidden pages.
    • Most scans finish in well under a minute.

  2. Stage 2: Your report

    A grade from A to F, and every finding rated by severity: critical, high, medium, low or for information.

    • Each finding says what we saw, what it could mean for your business, and how to fix it on the platform you used.
    • Written in plain English. No scare stories, no jargon you have to look up.

  3. Stage 3: The full report by email

    You see your grade and the list of findings straight away. Add your email address to unlock the full explanations and fixes.

    • We use your email address to send the report. Marketing emails are a separate choice, off unless you tick the box.

  4. Stage 4: The verified scan

    Prove you own the domain and you can run deeper checks that would not be fair on someone else's site.

    • Create a free account and add your site. Put one proof in place, a DNS TXT record or a small file in /.well-known, and check it. Either one is enough.
    • Then run a verified scan from your dashboard. It runs every free check, plus five deeper ones: sensitive files such as /.env and /.git, folders that list their contents, CORS on your own API, Supabase tables readable without a login (we ask only for row counts, never your data) and unguarded admin areas.
    • We check your proof again before every verified scan. Remove the record or file and the deeper checks stop.
    • Turn on free weekly monitoring from your dashboard and we run a verified scan every week, checking your proof first, then email you only when a new finding appears or one is fixed.

    Every request a verified scan makes

  5. Stage 5: The audit, if you want one

    A person reviews your app properly, including everything a scan cannot reach, for a fixed £395.

    • The fee is credited in full against any fix work you book with us afterwards.

What we store, and for how long

We keep what we need to show you your report, and no more.

Anonymous scans
The address scanned and the results, deleted after 30 days.
Leaked secrets
Never stored in full. We keep only the first 4 and last 4 characters, so you can recognise which key it was.
Your IP address
Stored only as a keyed hash, used to stop the scanner being misused.
Your email address
Only if you give it to us, to send your report. Marketing is a separate opt-in.
See what we check See pricing