About ShipSecurely
Last updated
ShipSecurely is a free directory of ways apps built with AI coding tools get hacked, and how to check and fix them. The public name and the default URL, https://shipsecurely.dev, live in lib/site.ts. Reading a page here is not a claim that someone from ShipSecurely reviewed your app.
The guides are for people using Cursor, Claude Code, Lovable, Bolt, Replit, v0, and similar tools. The app runs. The auth is a redirect. The database was created by a prompt. These pages are the short list of what to verify before other people use it.
What a page is
Each issue says what the bug is, how to look for it in about five minutes, how to fix it on the platforms where it actually shows up, and a prompt you can paste into a coding agent. Read the diff the agent produces. The prompt is a starting point, not a merge button.
Severity is editorial, not a CVE score. Critical means someone can reach other people's data or your money without much skill. High means a real path that takes more work. Medium means a missing control that makes other bugs worse, or a launch gap that is not itself an exploit.
What this site will not do
It will not invent statistics, breach stories, or quotes. It will not call itself a penetration test. It will not give legal advice. The privacy and terms guide says that in the page itself.
Tool pages only state what a public page said, and they list what was not on that page. Pricing changes. Open the source link before you make a decision.
How pages get added
Issues, tools, and the checklist are markdown files in content/. The README explains the shape. The site fails the build if a new issue is missing a check, a fix, a prompt, or a checklist line. That is on purpose.