Terms

You may only scan what you are allowed to test

The checkbox on the homepage is required. You confirm you own the app, or that the owner has authorized you to test it. Do not point ShipShape at someone else’s production system, a bank, a government site, or anything you would not want fetched from your own network.

Unauthorized access to a computer system can be a crime. In Slovenia, Criminal Code article 221 covers entering an information system without permission. ShipShape is not a pentest service and will not run active probes on the free tier.

What the free check does

It sends ordinary GET requests: the page, same-origin scripts, source maps those scripts name, and a short fixed list of well-known paths such as /.env and /.git/config. It does not guess passwords, fuzz parameters, write data, attempt logins, or query Supabase or Firebase.

What we keep

The redacted report is kept for about 30 days so you can share the link. A waitlist email and the tier you clicked are kept until you ask for deletion. The privacy page describes both.

Launch Report refund

The €19 Launch Report is a one-off unlock of the passive check you already ran: every finding’s location, fix steps, copy-paste snippets, and a PDF. The price is €19, VAT not applicable. DDV ni obračunan na podlagi 1. odstavka 94. člena ZDDV-1 (VAT not charged under Article 94(1) of the Slovenian VAT Act). It does not scan anything new. If that report is unusable — the private link does not open, or the PDF does not match the check you paid for — email hello@mail.shipshapescan.com within 14 days of payment and the €19 will be refunded. A report that shows problems you would rather not see is not unusable.

Not a guarantee

A grade is a summary of this passive pass. An A does not mean the app is secure. A finding can be a false positive. ShipShape’s liability for the free check is limited to the price you paid for it, which is zero. Liability for a Launch Report is limited to the €19 paid for that report.

Secrets

Matched secrets are masked to the first four and last four characters in the report. Do not paste a live secret into the URL field. If we show you a leaked key, rotate it. The report is not a place to copy the key from.