Paste your deployed URL. ShipReady fetches the actual site your visitors see — HTML and JS bundles included — and checks what actually burns vibe coders: leaked keys, open Supabase tables, unprotected APIs, and the share-killing missing OG image.
Don't upload your code to a stranger's tool.
Your live site is already public. We scan what's served — no zip, no GitHub access, no trust barrier, no liability for your source.
Anyone can run the public scan on any URL. Sensitive results stay locked until you prove the site is yours.
Our servers fetch the public page directly — we never ask for code, repo access, or passwords.
Public checks — instant, no proof neededTitle, viewport, favicon, meta description, OG image, image alts, console.log / debugger in served JS.
Sensitive checks — lockedStripe / OpenAI / Supabase secret keys in the client bundle, Supabase tables without row-level security, unprotected API routes.
Prove it's yours to unlockAdd one meta tag we generate, click verify, and only then do secret findings appear.
Blockers first. Every failure comes with a fix you can paste straight into Cursor, v0 or Lovable.
AI tools love putting sk_live_…, OpenAI keys and Supabase service_role keys in client code “just to make it work.” Anyone can view-source and drain your account. We scan the served JS bundles — and only tell the verified owner what we found.
If row-level security is off, your anon key (which is public by design) lets anyone read — or write — your whole database. Same story for /api routes with no auth check. These two are the real vibe-code disasters, not a missing README.
No og:image means your big X / Product Hunt launch post renders as a grey box. No favicon, default “Vite App” title, and console.logs in production do the same damage, quieter. All checked from the live HTML, no verification needed.
Each guide answers one exact problem people search for, walks through the fix step by step, and ends with a free scan of your whole site — so one fixed issue doesn't leave four others hiding.
sk_live must never ship to the browser, and how to move it to a server route.
Link previews look broken on X →The 3 OG tags every launch needs, at the right size (1200×630).
OpenAI key in client bundle →How keys leak through NEXT_PUBLIC_ variables, and the proxy-route pattern that fixes it.
Anyone can call your /api route →Add an auth check in 6 lines before someone scripts your endpoint.
Shows for any URL: title & default-title check · viewport · meta description · favicon · OG title / description / image · Twitter card · image alt text · oversized / unlazy images (from markup) · console.log & debugger in served JS · HTTPS.
Only after ownership verification: OpenAI key in bundle · Stripe secret key in bundle · Supabase service_role key in bundle · Supabase RLS risk · unprotected API routes.
The free scan shows your score and public findings. Paid unlocks full re-scans, fix history, and monitoring for new leaks.
Unlimited re-scans for that site. Verify once, scan forever.
Get Single Project — $19 →Free scan needs no card and no signup. Paid plans check out securely via Stripe (test mode).