ShipCheck scans a live app URL from the outside for leaked secret keys, exposed /.env and /.git files, missing security headers, SSL and domain expiry, and SEO gaps. It is aimed at apps built with AI builders such as Lovable, Bolt and v0. The page asks that you own the site or have permission to scan it.
The summary is free with no sign-up and takes about 20 seconds. The full report needs an email. Solo is $12 a month (1 app, weekly scans) and Builder is $29 a month (5 apps, daily scans). Both include daily uptime checks.
AI builders make it fast to ship, and just as fast to ship a secret key in a JavaScript bundle or a noindex tag left over from a preview. Terry wanted a cheap outside-in check that re-runs on a schedule and tells non-security people what changed.