---
name: SafeToShip
slug: safetoship
url: https://safetoship.dev/
category: URL scanning
bestFor: "A live-URL check aimed at vibe-coded apps, with a paid unlock for the full write-up."
freeTier: yes
price: "$0, $9, or $24/mo"
checks:
  - live-url
  - supabase-rls
  - secrets
freeTierNote: "The pricing page headline is 'Free scan in 60 seconds. Full report for $9. Unlimited for $24/mo.' The FAQ on that page says a free user gets 1 scan per month, a $9 payment unlocks one full report without an account, and Pro at $24/month is unlimited scans, history, a badge, and monitoring. The same FAQ says the scan runs 10 modules against the live URL: headers, SSL/TLS, exposed files, leaked API keys in JavaScript, Supabase RLS, Firebase rules, CORS, cookie flags, email authentication, and tech stack detection. The plan cards repeat one long feature list, so this entry does not assign each bullet to a tier beyond what the headline and FAQ say."
verifiedOn: "2026-10-14"
sources:
  - https://safetoship.dev/pricing
  - https://safetoship.dev/
unknowns:
  - "Which of the repeated feature bullets are included before the $9 unlock. The cards do not separate them cleanly."
---

Point it at a URL you own. The pricing FAQ says the requests are read-only, and that a Supabase or Firebase check reads at most one row and does not write. Paid results include a prompt aimed at the coding tool that built the app. The score formula on that page starts at 10.0 and subtracts points by severity. That formula is the vendor's, not a count of incidents.