See your site the way a stranger does.

ShipCheck loads the URL you submit, follows at most three redirects after checking each destination, reads up to five JavaScript files from the same origin, then requests a fixed set of seven well-known paths once each. It checks common secret formats, exposed files, and selected response headers.

It does not crawl links, submit forms, log in, fuzz inputs, exploit vulnerabilities, or make requests to another site's scripts. Each request has a five-second timeout and response-size cap; a scan has a twenty-second budget and at most fifteen outbound requests.

Ownership matters: only scan a site you own or have written permission to test. A clean result means only that these specific checks found nothing. It is not a security audit and does not mean a site is secure.

Privacy: we store the scan result and masked evidence for seven days, then delete it. We do not store full detected secrets or page content. Query strings are removed from saved and displayed URLs.