ShipCheck

One command. A pre-launch report card for your vibe-coded app.

You built something fast with AI and you're about to ship it. Did a real API key end up in the bundle? Is .env committed? Any <img> missing alt? No <title>? A vulnerable dependency? The stuff that breaks (or leaks) in production is exactly the stuff that's easy to miss when you're moving fast.

ShipCheck scans your project locally and hands you a graded report card before you deploy.

npx @dukotah/shipcheck

No install. No signup. No account. Nothing leaves your machine — it reads your files and prints a report, that's it. Zero runtime dependencies.

  ShipCheck — pre-launch report card  v1.0.0

   C  72/100
  1 critical · 2 high · 3 low

  Hard-coded secrets  (1)
     CRITICAL  AWS access key ID  src/config.js:14
        Hard-coded credentials in source can be extracted from your repo, bundle, or git history.
        → fix: Move it to an environment variable and add the file to .gitignore. Rotate the key.

  Environment & secrets config  (1)
     HIGH  Client-exposed secret  .env:3
        NEXT_PUBLIC_ vars are bundled into client JS and shipped to every visitor.
        → fix: Drop the NEXT_PUBLIC_ prefix; read it server-side only.

  ✓ Passed: Security headers, Build & exposure artifacts, Project hygiene

What it checks

Check	Catches
Hard-coded secrets	API keys, tokens, private keys, connection strings, JWTs committed in source
Dependency health	Missing lockfile, unpinned (*/latest) versions, committed node_modules, abandoned & typosquatted packages
Environment & secrets config	Committed .env, missing .env.example, secrets exposed via NEXT_PUBLIC_/VITE_/REACT_APP_
Security headers	Missing CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy in your deploy config
Build & exposure artifacts	Committed dist/build, shipped source maps, a deployed .git folder, editor/OS junk
SEO & metadata	Missing <title>, meta description, Open Graph tags, viewport, favicon, robots.txt/sitemap.xml
Accessibility basics	<img> without alt, icon buttons with no label, unlabeled inputs, missing lang, positive tabindex
Project hygiene	Missing README / LICENSE / .gitignore, incomplete package.json, leftover TODO/console.log/scaffold text

Usage

npx @dukotah/shipcheck                      # scan the current directory
npx @dukotah/shipcheck ./my-app             # scan a specific folder
npx @dukotah/shipcheck --fail-on high       # exit non-zero if anything is high or worse (great for CI)
npx @dukotah/shipcheck --only secrets,deps  # run just these checks
npx @dukotah/shipcheck --format markdown    # Markdown (PR comments / job summaries)
npx @dukotah/shipcheck --format sarif       # SARIF for GitHub code scanning
npx @dukotah/shipcheck --json               # machine-readable JSON
npx @dukotah/shipcheck --list               # list available checks

Options

Flag	Description
--fail-on <sev>	Exit 1 if any finding ≥ critical|high|medium|low (default none)
--format <name>	terminal (default) · json · markdown · sarif
--only <ids>	Comma-separated analyzer ids to run
--skip <ids>	Comma-separated analyzer ids to skip
--ignore <globs>	Extra ignore globs
--no-color	Disable ANSI colors

Config file

Drop a .shipcheckrc.json in your project to set defaults (CLI flags win):

{
  "failOn": "high",
  "skip": ["a11y"],
  "ignore": ["vendor/**", "*.min.js"]
}

In CI (GitHub Actions)

Gate every push and get a report in the job summary:

- uses: Dukotah/shipcheck@v1
  with:
    fail-on: high

Or run it directly:

- run: npx @dukotah/shipcheck --fail-on high

For GitHub code scanning, emit SARIF and upload it:

- run: npx @dukotah/shipcheck --format sarif > shipcheck.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: shipcheck.sarif

How it works

ShipCheck walks your project once (respecting .gitignore), hands every check a shared read-only view of the files, collects findings, and scores them into a grade. Each check is an independent ~30-line module in src/analyzers/ — adding one is trivial; see CONTRIBUTING.md. It never makes a network request and never writes to your project.

Why

Most of these checks exist as separate web tools — you paste your code into one site, your headers into another, your token into a third. That's slow, and pasting a live secret into a random website is its own risk. ShipCheck folds the whole pre-launch checklist into one local command that lives in your workflow.

License

MIT © Copper Bay Labs. A free developer tool — see the rest of the suite. Want your app reviewed or hardened for you? Copper Bay Tech.