Shipleak

Security & AI visibility

Your app is live. Something on it is wide open.

Paste a URL. In about twenty seconds you get the one issue that actually matters — in plain English, with a fix prompt you can paste straight into Cursor, Claude, or whatever built it.

No signup. Read-only — we never touch your site. Full results, free.

vercel.com
0/13
  • checking_

scanning

A real scan of vercel.com, captured 2026-07-31 · replayed at true speed

Fingerprints the stack you actually shipped

  • Next.js
  • Astro
  • Remix
  • SvelteKit
  • Nuxt
  • Vercel
  • Netlify
  • Supabase

What a finding looks like

One issue, followed all the way through.

This is the worst finding the scanner can produce, and exactly how it's reported.

  1. 01

    We fetch the page like a browser would

    Response headers, the HTML, and every same-origin script tag it links to. Read-only, a few dozen GET requests, nothing submitted.

  2. 02

    We read your bundles the way an attacker would

    Not for style — for key formats. Stripe live keys, AWS access key IDs, GitHub tokens, and Supabase JWTs, which we decode to tell the harmless anon key from the service_role key that bypasses every policy you have.

  3. 03

    We tell you what it means, not what it's called

    “Anyone can read and write your database” — because that's the actual consequence. Not “RLS policy misconfigured on public.profiles”.

  4. 04

    We hand you the fix, written for your stack

    Because we fingerprinted the framework first, the prompt references next.config.ts or hooks.server.ts or vercel.json — whichever you actually use — and tells you to rotate the key, which removing it from the bundle does not do.

Critical

Your Supabase service_role key is in your JavaScript

This key bypasses every row-level security policy you have. Anyone who opens devtools can read, change, or delete every row in your database — all your users’ data, regardless of what your policies say.

found in /_next/static/chunks/main-8f2c1e.js

  • HighNo Content-Security-Policy header
  • MediumGPTBot and ClaudeBot are blocked
  • LowNo llms.txt
  • PassTLS, HSTS, X-Frame-Options all good
See what yours says

65 checks

Most scanners read your headers and stop.

Headers are the easy half. The things that actually leak data — a service-role key in a bundle, a readable .env, an API that answers any origin — need someone to go and look. So does everything on the AI-visibility side.

Checks performed by Shipleak compared with a typical header-only scanner
CheckShipleakHeader scanner
Security headersCSP, HSTS, X-Frame-Options, nosniff, Referrer-Policy✓✓
TLS certificate & expiryReal handshake, not just a padlock check✓✓
CORS misconfigurationProbes with a foreign origin, checks credentials pairing✓—
Secrets in your JS bundlesStripe, AWS, OpenAI, GitHub, Google, Slack, Supabase keys✓—
Exposed .env and .gitWell-known paths, with SPA false-positive filtering✓—
AI crawler rulesGPTBot, ClaudeBot, PerplexityBot, Google-Extended✓—
llms.txtPresence and content✓—
Structured dataJSON-LD parses, and declares a real @type✓—
Server-rendered contentWhether crawlers see anything without running JS✓—
Framework-aware fix promptsnext.config.ts, not a generic .htaccess snippet✓—
65 checks, every one running against your live URL102
Run all 65 on your site

“Header scanner” describes the category of free tools that read response headers and stop. No specific product is measured here.

What we do with your data

A scanner you'd be comfortable pointing at production.

We're asking you to let us look at your site. That only works if what we do is boring and specific, so here it is.

Read-only, always

We request pages the way a browser or Googlebot does. Nothing is submitted, no forms are filled, no passwords are guessed, and we never write to your site. It's a few dozen ordinary GET requests.

Secrets are redacted before they leave the scanner

When we find a key, we keep the first seven characters, the last four, and the length. The full value never enters our database and is never shown in a report.

Your pages aren't stored

We hold the HTML and your bundles only for the seconds it takes to analyse them. What we keep is the finding — the URL, the severity, the explanation.

Reports are unlisted, not public

A report lives at an unguessable link and our server renders it. The database itself isn't readable from the browser, so nobody can enumerate other people's scans.

Scan a site

Pricing

It's free. There isn't a plan to upgrade to.

Every check, every finding, every fix prompt, on every scan. No signup, no card, and nothing held back — a report you can't read isn't shareable, and sharing is how people find us.

Sponsor slots in the margins are what pay for it, which is why the scanning doesn’t need to. Take a slot.

Questions

The ones people actually ask.

Still unsure? The fastest answer is to run a scan — it costs nothing and takes less time than reading this column.

Scan a site
Is scanning my site safe?
Yes — every check is read-only. Shipleak requests your pages the same way a browser or Googlebot would, reads the response headers and the JavaScript you already serve to the public, and checks a handful of well-known paths like /robots.txt and /.env. Nothing is submitted, no forms are filled, no passwords are guessed, and we never write anything. It’s a few dozen ordinary GET requests.
Do you store my data?
We store the scan result — the URL, the findings, the detected stack — so the report has a permalink you can share. We don’t store your page contents or your bundles beyond the moment we analyse them, and any secret we detect is shown truncated and stored only as a fingerprint, never in full. Anonymous scan reports are unlisted but anyone with the link can read them, so don’t share one for a site you’d rather keep quiet.
What's AEO?
Answer Engine Optimization — SEO’s equivalent for AI assistants. When someone asks ChatGPT or Claude or Perplexity a question your site could answer, the model has to be able to fetch, read, and trust your page. That means robots.txtthat doesn’t block AI crawlers, content that exists in the HTML rather than appearing after a client-side fetch, valid JSON-LD, and increasingly an llms.txt. Plenty of well-built apps are invisible to every one of them.
How is this different from other scanners?
Scope and delivery. Most scanners run everything and return a hundred rows sorted by category, which is a to-do list you will never start. Shipleak runs two categories properly, leads with the single finding most likely to hurt you, says what it means in a sentence you could read aloud, and hands you a fix prompt written for the framework it detected. It also finishes in about twenty seconds and streams results as they land.
What doesn't it check?
Deliberately: no accessibility, performance, or compliance audits, no uptime monitoring, and nothing that requires access to your repo or your database. If a finding needs credentials to confirm, we tell you what to check rather than guessing.