# Shipnull

> Shipnull is a free launch-safety scanner for vibe-coded and AI-built web apps. Paste a live public URL and get a safety report in about a minute. Tagline: "Zero findings. Ship it."

## What it checks
- Exposed secret files on common paths (/.env, /.env.local, /.git/config, /.aws/credentials, /config.json, /.npmrc and more)
- Leaked API keys in the homepage HTML and same-origin JavaScript bundles (OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, Google, Supabase service_role, private keys); keys are always redacted in reports
- Security headers: Content-Security-Policy, X-Frame-Options / frame-ancestors, HSTS, X-Content-Type-Options, Referrer-Policy, X-Powered-By, HTTPS
- Auth surface (login/signup) and payment surface (Stripe/checkout) detection with server-side advice
- A lightweight rate-limiting signal (8 polite GETs)

## Output
Overall risk (Low / Medium / High), findings with severity, and up to five plain-English next steps.

## Safety and limits
Read-only GET requests only, max 40 requests per scan, 8 second timeout, standard ports only, private/internal addresses refused. Not a penetration test.

## Pricing
- Free: URL scan, no login, no API key.
- Coming soon (waitlist): repo scan with automatic fix pull requests.

## Links
- Home: https://shipnull.com/
- Scan API: POST https://shipnull.com/api/scan with JSON {"url": "https://example.com"}