The free Preflight opens on this page. Nothing to sign up for yet.
Pre-launch security testing for apps built with coding agents
We attack your app.We prove the finding.We re-attack the fix.
ShipSafe is the security gate for AI-built software. It runs the attacks a real attacker would run, quotes the request and the response that prove each one, and will not mark a finding Fixed until a retest can no longer reproduce it.
Built by AI. Tested like a hacker. Ready to ship.
Run the free Preflight now
- Launch Audit
- $349, one app, one-time
- Turnaround
- Same day, no sales call
- On production
- Safe Mode is read-only
Specimen finding, as delivered
A logged-in customer can retrieve another customer’s invoices
GET /api/v1/invoices/4821
# request, sent as dana@acme.io GET /api/v1/invoices/4821 HTTP/1.1 Host: app.example.com Authorization: Bearer eyJhbGciOiJIUzI1… # response HTTP/1.1 200 OK Content-Type: application/json { "invoice_id": 4821, "account": "northwind-labs", "billing_email": "ops@northwind-labs.com", "amount_due": "$4,180", "card_last4": "4242" }
Scroll the evidence sideways
Business impact: any logged-in customer can read every other customer’s invoices, including the billing email and card metadata.
The only question that matters, the night before you launch
Your app went from idea to production in weeks. Authentication, tenant isolation, storage rules and API responses were written at speed by a coding agent. Nobody read them.
So you ship and hope, or you paste a scanner report into your editor and hope harder. Independent research puts roughly 10% of apps built this way in a secure state, and Veracode found about 45% of AI-generated code failing security tests.
- 01Does authentication hold, or does it only hold in the UI?
- 02Can customer A read customer B’s rows?
- 03Does an endpoint return more than the screen shows?
- 04Is a storage bucket serving files without a signed URL?
- 05Is a live key sitting in your JavaScript bundle?
Today there are three bad options
| Option | Cost | What comes back |
|---|---|---|
| A human penetration test | $5,000 to $20,000 | A real assessment, weeks after the date you needed it |
| A monthly scanner | $19 to $39 per month | Severity labels and a count of checks, with no proof that any of it is exploitable |
| Asking the agent that wrote it | $0 | A reassuring answer from the one witness that cannot be trusted |
| ShipSafe Launch Audit | $349, once, same day | Findings reproduced with the request and the response, a prompt that fixes each one, and a retest that has to fail before the finding closes |
Scroll the table sideways
A scanner tells you a header is missing. ShipSafe shows you the response body containing another customer’s data that it pulled out of your app.
Detect, validate, explain, fix, retest
- 01Detect
Recon maps the real surface: pages, forms, parameters, endpoints, auth flows, roles and uploads.
- 02Validate
Every candidate has to be reproduced with captured evidence, or it is downgraded or dropped.
- 03Explain
The finding becomes one sentence about what an attacker gains, in money and consequence.
- 04Fix
You get a copy-ready prompt for the coding agent that wrote the bug. You paste it and redeploy.
- 05Retest
ShipSafe replays the exact original attack and writes Fixed or Reopened. One button.
Nothing reaches a report as Critical or High on suspicion. The score and the verdict move only when reality moves.
Why you can point us at production
Ownership is proven first
Before a single crafted request: a DNS TXT record or a file at /.well-known/shipsafe-verification.txt, plus a signed authorization and a declared scope.
Blast radius is bounded
Safe Mode is read-only. It retrieves what it should not be able to retrieve, and never writes, deletes, overwrites or sends mail. Proof Mode is non-production only, behind an explicit tick.
Coverage is stated, never implied
An audit that ran without test accounts cannot return Ready to ship. The best verdict available to it is Ship with conditions: authorization untested.
We would rather lose the compliment than earn it dishonestly.
What comes back
The verdict is the largest object on the page, and on a bad day it is the only line you have to read.
| ID | Finding | Severity | Confidence | Status |
|---|---|---|---|---|
| SS-2026-0148 | A logged-in customer can retrieve another customer’s invoices | CRITICAL | Confirmed | Fixed |
| SS-2026-0149 | A password reset token stays valid after it has been used | HIGH | Confirmed | Open |
| SS-2026-0151 | The admin endpoint accepts a role change from a customer session | HIGH | Verified | Open |
| SS-2026-0153 | A live payment key is readable in the client bundle | MEDIUM | Confirmed | Fixed |
| SS-2026-0157 | Uploaded files are served from a public bucket without a signed URL | MEDIUM | Verified | Open |
Not tested: authorization between roles, because no test accounts were supplied. Not tested: business logic and workflow abuse, which is Proof Mode and non-production only. Retests on this app stay free until 21 Sep 2026.
Scroll the table sideways
Worked example. Findings are a table, the score is a plain number with a rule under it, and nothing here is a gauge.
The price is on the page
Passive checks on any URL. Score, verdict, severity counts, and one finding fully unlocked with its evidence and fix prompt. No signup, no card.
One app. Authorized active assessment: recon, authentication, authorization, API, input handling, configuration and file handling. Unlimited retests for 30 days.
One app. Adds multi-role and multi-tenant authorization testing, OpenAPI-driven API coverage, workflow abuse, a shareable PDF report, and 60 days of retests.
One-time, per app, per launch event. No subscription, no seats, no sales call, and no form to fill in before you can see the number.
A clean result is a delivery, not a failure. You get the stamped report, an embeddable Tested by ShipSafe badge, and one free re-audit of the same app within 30 days. We are paid for the test, not for bad news, so nobody here has a reason to inflate a severity.
Nothing else to do before you launch.
That sentence is the object we are building: one stamped verdict you can forward to a customer, to an investor, or to yourself at 23:00 the night before you go live.
There is nothing to sign up for. The free Preflight opens on this page: you paste your app URL, and about a minute later you have a score, a verdict and one finding with its evidence.
