Perimeter & TLS
- 01Security headers (CSP, HSTS, XFO)Active Baseline
- 02TLS certificate & cipher suiteActive Baseline
- 03HTTPS redirect hygieneActive Baseline
- 04MIME sniffing & framing defenseActive Baseline
- 05Referrer policy & COOP/COEPActive Baseline
Security, with evidence
Ship fast.Know what's exposed.
Security testing for SaaS developers. Scan your app, understand the risks, and verify your fixes.
By selecting Scan, you confirm that you own this site or have permission to assess it. ShipSafe runs bounded checks against this exact hostname.
Scan tree
Your targets and recorded runs are held in memory and reset when the service restarts.
Loading scans…
1 website URL0 integrations needed100% evidence first
Exact-host scope · Evidence with every finding
What a website scan can assess.
MethodologyCookies & Session
- 01Secure & HttpOnly attributesActive Baseline
- 02SameSite isolation (Strict/Lax)Active Baseline
- 03__Host- & __Secure- prefixesActive Baseline
- 04Session invalidation on logoutDeep Profile
- 05Session fixation & token replayDeep Profile
API & Data Exposure
- 01Stack trace & debug error leakageActive Baseline
- 02CORS wildcard & origin reflectionActive Baseline
- 03Server banner & version disclosureActive Baseline
- 04BOLA & Object authorizationDeep Profile
- 05Multi-tenant boundary isolationDeep Profile
App & Integrations
- 01Supabase / Postgres RLS reviewDeep Profile
- 02Client-side secret & key leaksArtifact Audit
- 03Payment webhook signature & replaySandbox Test
- 04Vulnerable dependencies & CVEsArtifact Audit
- 05AI prompt injection & tool boundariesSandbox Test
ShipSafe verifies public perimeter resilience via zero-setup URL baseline scans, with deeper profiles for multi-tenant auth, database RLS, payment webhooks, and AI agent boundaries.
Inside a baseline assessment.
This static archived example shows the report format. It is separate from your target and is not a live scan.
Static examplehistorical · URL baseline
Example only · no live scan is runningTLS · redirects · headers · cookies · CORS13 bounded HTTP/TLS checks in the URL baselineExact hostname only · no exploits or subdomain discoveryLive evidence and score appear here when your scan completes
See a sample report A score without coverage is reassurance.
Score
Severity-weighted over assessed controls only. Any open Critical caps the display at 40.
Coverage
Assessed applicable controls ÷ applicable controls. Skipped or failed tests never raise it.
Confidence
Quality and repeatability of the evidence behind each finding.
No weakness observed under the defined test — only after the check completes.
They remain untested and receive no coverage credit. This baseline does not assign an overall security score.
No. AI tool permissions, retrieval isolation and agent behavior require a separate authorized fixture and additional access.
Current domain-ownership verification plus explicit scope acceptance. Active testing needs separate approval.
Sample findings.
Evidence and fixes from a recorded baseline.
Content Security Policy is missing
header content-security-policy · example.com
The recorded baseline found no Content-Security-Policy header. Historical summary; original response bytes unavailable.
Start with a report-only policy, review required resources, then enforce and retest.
X-Content-Type-Options header is missing
header x-content-type-options · example.com
The recorded baseline found no X-Content-Type-Options header. Historical summary; original response bytes unavailable.
Send X-Content-Type-Options: nosniff on HTML responses, then retest.
Strict-Transport-Security is missing
header strict-transport-security · example.com
The recorded baseline found no Strict-Transport-Security header. Historical summary; original response bytes unavailable.
Configure HSTS after verifying HTTPS coverage across the affected domains, then retest.
Not ready to ship?
Most teams aren't. Verify, scan, fix, retest.
Open your scan terminal. Keep every recorded result in view.