Flags committed env files and token-like values for OpenAI, Supabase, Stripe, Razorpay, and similar services.
Open-source launch gate
Ship AI-built apps with fewer blind spots.
BeforeShip scans your app before deploy and flags the production basics AI coding agents often miss: secrets, unsafe routes, payment risk, Supabase gaps, and CI readiness.
npx beforeship@latest scan .
npx beforeship@latest scan-github owner/repo
Cursor
Codex
Claude Code
Lovable
Replit
$ npx beforeship scan . --fail-on high --min-score 90
BeforeShip launch gate
Target: ./my-ai-built-app
92/100
Verdict SHIP
2 medium findings
- Missing webhook idempotency evidence
- Auth route has no visible rate limit
Reports written to .beforeship/
Built for the failure modes that show up right before launch.
Looks for missing auth guards, trusted user-id usage, wildcard CORS, weak validation, and missing rate limits.
Checks Stripe and Razorpay webhook signature handling and idempotency patterns before money starts moving.
Scans for service-role exposure, RLS signals, owner policies, and public bucket risk in common app layouts.
Looks for health routes, test signals, env examples, and other practical markers that reduce launch guesswork.
Use --fail-on and --min-score to block risky pull requests in GitHub Actions.
Scan public repositories through the GitHub API without cloning, then optionally create issues for top findings.
One command locally. One gate in CI.
Run BeforeShip against a project folder and get a score, verdict, findings, and reports.
Each finding includes confidence and fix guidance so contributors can turn warnings into pull requests.
Set CI thresholds for high-severity findings and minimum launch score before merge or deploy.