// the pre-launch checkup for indie builders and small teams
Get the green light before you ship.
ShipGreenLit gives apps you built fast a friendly pre-launch checkup — catching leaked keys, open databases, and weak headers before your users do. Run a free check, then expand any module to see exactly what it looks for.
// what is ShipGreenLit?
A security checkup that tells you whether your app is safe to ship — then keeps watching.
People ship production apps faster than ever, often without a security background. ShipGreenLit is built for the builder who just wants a trustworthy green light before going live — and an alert the moment a deploy puts that at risk. It is deliberately honest about its limits: it never labels machine output as “validated,” never auto-writes security-critical code for you, and even passes its own scanner.
Passive surface analysis
Grades your live responses against real checks — HSTS, CSP, CORS, frame and MIME protections, and leaked server fingerprints.
Non-destructive datastore check
An empty insert the database rejects before any row is written — gated behind signed proof that you own the target. Never exploits or modifies data.
Live re-verification
Before showing a fix, it re-probes the target so you only see issues that still reproduce right now. No nagware, no false-positive noise.
Curated, copy-paste fixes
Every finding ships with a hand-authored, known-correct remediation tailored to your detected stack — free, no AI guesswork.
Live Checkup
The core experience — run it on any site you own// Ready when you are — enter a URL below to start your checkup
Before any active check, prove you control https://example.com. Choose any one of three methods, publish the challenge token, then verify. This proof is required to sign an authorization.
Example · Add a DNS TXT record
_shipgreenlit.example.com TXTshipgreenlit-verify=<token>Detection Coverage
The vectors ShipGreenLit verifies with live checks today. A capability map, not target exposure.
Security Score
—
Live Critical Findings
—
Score = 100 − (25 × critical + 8 × warning), live findings only. "N/A" when probes return no results.
Checkup Modules
Live checks + roadmap, clearly taggedObjective
Statically scan the shipped client bundle, public env vars, and inline scripts for live API keys, tokens, and credentials that should never reach the browser.
Checks
- Stripe / OpenAI / AWS live key signatures (sk_live_, sk-, AKIA…)
- NEXT_PUBLIC_ vars containing high-entropy secrets
- JWT signing secrets embedded in client code
- Hardcoded DB connection strings
Output
Per-finding file path, line number, and key fingerprint (masked).
Objective
Authenticate as an anonymous client and attempt reads/writes against every exposed table and view to detect missing Row Level Security policies, owner-definer view bypasses, and tables where RLS is explicitly disabled.
Checks
- Unauthenticated SELECT on user-scoped tables
- Anonymous INSERT / UPDATE / DELETE attempts
- Public-schema views with SECURITY DEFINER that bypass RLS on base tables
- Tables with RLS explicitly disabled (relrowsecurity = false) exposed to PostgREST
- Service-role key reachable from client
Output
Table-by-table and view-by-view matrix of allowed anonymous operations, with per-finding SQL patches.
Objective
Evaluate response headers across all routes for permissive CORS, missing CSP, and absent transport-security directives.
Checks
- Access-Control-Allow-Origin: * with credentials
- Missing Content-Security-Policy
- Absent Strict-Transport-Security
- X-Frame-Options / clickjacking exposure
Output
Header grade (A–F) per route with remediation snippets.
Objective
Burst-fuzz public API routes to determine whether rate limiting, throttling, or bot protection exists before abuse is possible.
Checks
- Unbounded request volume to /api/*
- Auth endpoints vulnerable to credential stuffing
- Expensive queries without throttle
- Missing per-IP / per-user quotas
Output
Requests-per-second tolerated before any 429 response.
Objective
Submit crafted payloads to inputs, query params, and AI prompts to surface injection vulnerabilities including the LLM layer.
Checks
- SQL injection on dynamic queries
- Reflected & stored XSS in rendered content
- Prompt injection / jailbreak on AI routes
- Server-side template injection
Output
Reproducible payloads with affected sink locations.
Objective
Aggregate all findings into a severity-ranked report with copy-paste patches and a single overall security score.
Checks
- CVSS-style severity scoring
- Curated, stack-tailored fix per finding
- Exportable PDF / Markdown report
- Re-scan diff against previous run
Output
Overall score 0–100 + ranked, actionable fix list.
Roadmap & Backlog
What enterprise-grade requires nextWe lead with what we can defend. Today ShipGreenLit ships real, evidence-backed checks for secrets, security headers/CORS, and database exposure. Here is exactly what a senior security review will ask for next — and the order we will build it.
Up next
3Authenticated scanning (IDOR / BOLA)
~90% of real application risk lives behind login. Without a session we can't test broken object-level authorization — the #1 OWASP API risk.
Repo & git-history scanning (SAST)
Fast-built apps leak secrets in committed .env files and git history far more than in bundles. GitHub-connected gitleaks + dependency CVE scanning (OSV) 10x's coverage.
Command-line checkup (npx shipgreenlit)
Run the same pre-launch checkup from the terminal and wire it into CI, so a failing green light can block a deploy before it ships.
Backlog
5Rate-limit & abuse testing
Real burst testing measures observed 429 thresholds instead of guessing. Crosses into active testing, so it ships behind ownership verification.
Injection testing (SQLi / XSS / SSTI / prompt-injection)
Crafted-payload testing of inputs, params, and AI routes with reproducible evidence — the high-value findings currently shown only as simulated examples.
TLS / certificate analysis
Expected in any credible scanner: protocol versions, cipher strength, chain and expiry validation.
Findings lifecycle & reporting
Enterprise-grade means dedupe, suppression/accept-risk, ticket integration (Jira/Linear), trend-over-time, and SARIF/PDF export — not just a list.
Compliance control mapping
Mapping findings to SOC 2 / ISO 27001 / PCI controls is often the actual purchase justification for security buyers.
Launch Readiness
Honest scorecard — shipped vs. gatedPublic-Launch Readiness
Shipped & verified
- Passive probes (headers, bundle secrets, datastore exposure)ShippedReal findings from the live target — no fabricated results.
- Honest findings & scoringShippedScore derived from live findings only; simulated lines clearly excluded.
- Cryptographic authorization attestationShippedTOTP (RFC 6238) + PIN, HMAC-signed token bound to target/identity/time/nonce.
- Domain-ownership verificationShippedDNS TXT, .well-known file, or meta-tag proof of control required before any active probe.
- Passive-open / active-gated splitShippedPassive checks open to all; active probes refuse to run without attestation + ownership proof.
- Tamper-evident audit chain (DB-persisted)ShippedAppend-only, hash-chained log of every attestation and active scan in Postgres; integrity verified live.
- Persistent storage for audit chain & enrollmentsShippedNeon Postgres connected; audit log, enrollments, and issued attestations persist and are user-scoped. Verified via direct SQL.
- Real authentication & identity bindingShippedBetter Auth email/password; attestations bind to the verified account. Unauthenticated enroll/attest/verify return 401.
- Durable signing key & deployment postureShippedFull signing key setup, secret scoping, and deployment security documented on our trust page.
Roadmap before highest-scrutiny / enterprise
- Per-account rate limiting & bot defenseRoadmapAbuse controls and CAPTCHA on enrollment beyond the current per-IP limiter.
- Findings lifecycle, SARIF/PDF export, compliance mappingRoadmapDedupe, suppression, ticketing, and SOC 2 / ISO 27001 control mapping.
- Self-assessment: SBOM, threat model, third-party reviewRoadmapSecurity posture of ShipGreenLit itself, documented for buyer due diligence.
Built By
The same team shipping real ownership products// ShipGreenLit started as a sprint demo at an Amazon hackathon, built by the team behind TitleUnlock.com — and grew into a tool that monitors production apps. The same builder shipping real products that protect what people own.
TitleUnlock.com
Property title, decoded
Helps owners find, verify, and take control of their property title — cutting through the paperwork that usually hides behind closing tables and county records.
Vault
Coming soon
A digital vault for personal property records — deeds, titles, and proof of ownership — kept safe and instantly retrievable when disaster strikes or you simply need to prove what's yours.
Protecting real production apps
ShipGreenLit monitors these live apps for security regressions on every deploy.
TitleUnlock
titleunlock.comHeirs-property recovery platform helping families reclaim and clear title to inherited property.
RiseForth
www.riseforth.appISEE/SSAT test prep app for middle schoolers.
COPPA-compliant education app handling student data — held to the standard a children's app requires.
Origin
Why we built this — and what we found when we scanned ourselves// origin
Built for platforms where the security bar is absolute.
TitleUnlock helps families recover heirs property — land passed down without a will, often across generations. The people relying on it deserve a platform that is hardened, intentional, and continuously verified. ShipGreenLit is the instrument we built to make that verifiable. We built it at the AWS hackathon. Then we kept going.
TitleUnlock handles heirs property — families navigating years-long legal processes to recover land passed down without a will. The people relying on it are not abstract users. They are grandmothers, siblings, communities. The security posture of that platform is not a checkbox. It is a responsibility.
We built TitleUnlock with rigor, incorporating agentic AI tooling as it matured — not to move carelessly, but to move with precision. Security was always part of that thinking. What evolved was the need for an instrument that could verify our posture continuously, not just at a point in time.
Public scanners give you a snapshot. They do not tell you when a deploy quietly removes an HSTS header, weakens a CSP, or exposes a stack fingerprint. For a platform where trust is everything, that silent drift is unacceptable. We needed continuous verification as part of the workflow.
The AWS hackathon gave us 48 hours to build the thing we had been wanting. ShipGreenLit — continuous security monitoring that validates headers on every deploy, detects your stack, and alerts you the moment your posture regresses. We built it for TitleUnlock. We built it for teams that take this seriously.
TitleUnlock now runs on ShipGreenLit in production, monitored daily. The standard we hold ourselves to: if your grandmother is trusting this platform with her family's land, the security bar is absolute. That is the bar ShipGreenLit is built to hold.
Feedback & Contact
Shape the roadmap — tell us what to build// we build this with you
Found a gap? Want a check we don't have yet?
ShipGreenLit's roadmap is driven by the people shipping real apps. Tell us what would make your launch safer — bugs, ideas, or a check you wish existed. We read every message.