Scanner onlineRead-only · 40 req cap · 8s timeoutLDN --:--

NewLaunch safety for vibe-coded apps

Ship it.
Without shipping
your keys.

Paste your live URL. In about a minute Shipnull finds leaked API keys, exposed .env files and missing headers. Before someone else does.

$
shipnull — scan

    

    
7 high findings

    
sk_live…1234 redacted

  









  
What we check

  
Six checks. The ones that
actually get you breached.

  

    
const OPENAI_KEY = "sk-proj-••••••••••••6789";fetch("/api/chat", {  headers: { Authorization: key }});

      
Leaked API keys
OpenAI, Anthropic, Stripe, AWS, GitHub, Slack and Supabase service keys in your HTML and JS bundles. Redacted in every report.

    
/.env200/.git/config200/.aws/credentials404/config.json404

      
Exposed secret files
13 common paths probed, with catch-all detection so SPAs don't cry wolf.

    
strict-transport-securitycontent-security-policyx-frame-optionsx-content-type-options

      
Security headers
CSP, clickjacking, HSTS, nosniff, stack leaks.

    
••••••••

      
Auth surface
Login and signup flows that need checks on the server, not just the UI.

    
•••• 4242

      
Payment surface
Stripe and checkout that must be verified by signed webhooks.

    

      
Rate limiting
A light signal on whether abuse gets throttled.

  






  
How it works

  
  1. 01Paste a URL
    Any public http(s) site. No repo access, no install.
  2. 02We probe politely
    ~25 read-only GETs, capped at 40, 8s timeout each.
  3. 03Get a fix list
    Risk score, findings, and the exact next steps to ship safely.






  

    
Early access
Repo scan.
Fixes as pull requests.

    
A URL scan sees the outside. Connect your repo and we find missing auth checks, open database rules and unsigned webhooks, then open PRs that fix them.