Submit ProductSign in
Scan your live app for leaked keys and exposed files.
Grounded in available product and source data
ShipTight checks the parts of your app anyone can reach from a browser. Paste the address of a site you built with Lovable, Bolt, Cursor, Replit or v0, add an email, and a scan runs in about a minute with roughly twenty read-only requests.
You get a score, a grade and the findings that matter: exposed secret keys, downloadable .env or .git folders, plain http pages, missing safety headers, public source maps, weak cookie flags and mixed content. Fix prompts match your builder.
