SafeToShip
A live-URL check aimed at vibe-coded apps, with a paid unlock for the full write-up.
Last updated
- Price
- $0, $9, or $24/mo
- Free tier
- Yes
- Checks
- Live URL, Supabase RLS, Secrets
- Last verified
- Oct 14, 2026
What the public pages say
Point it at a URL you own. The pricing FAQ says the requests are read-only, and that a Supabase or Firebase check reads at most one row and does not write. Paid results include a prompt aimed at the coding tool that built the app. The score formula on that page starts at 10.0 and subtracts points by severity. That formula is the vendor's, not a count of incidents.
Free tier
The pricing page headline is 'Free scan in 60 seconds. Full report for $9. Unlimited for $24/mo.' The FAQ on that page says a free user gets 1 scan per month, a $9 payment unlocks one full report without an account, and Pro at $24/month is unlimited scans, history, a badge, and monitoring. The same FAQ says the scan runs 10 modules against the live URL: headers, SSL/TLS, exposed files, leaked API keys in JavaScript, Supabase RLS, Firebase rules, CORS, cookie flags, email authentication, and tech stack detection. The plan cards repeat one long feature list, so this entry does not assign each bullet to a tier beyond what the headline and FAQ say.
Left off the vendor's site
- Which of the repeated feature bullets are included before the $9 unlock. The cards do not separate them cleanly.
Sources
Listed on ShipSecurely
Put this on SafeToShip's site. The image links back to this page.
<a href="https://shipsecurely.dev/tools/safetoship"><img src="https://shipsecurely.dev/badge.svg" width="196" height="32" alt="Listed on ShipSecurely"></a>
Markdown version · Canonical page: https://shipsecurely.dev/tools/safetoship