Security and trust

Your code is yours. This page shows exactly where it goes when you use ShipShield, what we keep, how it is protected, and how to delete it.

Where your code goes

Your browserFree scanner on the home page. Code never leaves your computer.

Our server, in memoryDashboard, repo and live-site scans. Code is analysed and discarded.

Your historyOnly findings are saved: rule, file, line and, if you choose, a one-line snippet with secrets masked.

How you scan	Where it runs	What we keep
Local scanner in your own CI or on your computer	Your GitHub Actions runner or machine. No network calls	Nothing. Your code never reaches us.
Free scanner on the home page	Entirely in your browser tab	Nothing. Your code is not uploaded.
Quick scan in the dashboard	Our server, in memory	Findings only. One-line snippets are kept unless you turn them off.
GitHub repository scan (public repositories)	We download the repository into memory, scan it and discard it	Findings only. We never store your source code.
Live-site scan	Only after you prove you own the site. Passive requests, about 20 at most; we never log in or submit forms	Findings only
AI explanation (only when you ask)	You see the exact text first. After you select Send, up to 500 characters of the flagged line goes to Anthropic's API, with secrets removed	We keep nothing extra; the explanation is shown to you

Your controls

Don't keep code snippets. In the dashboard, under Privacy and data, turn off "Keep one-line code snippets". New scans then save only the rule, file and line.
See before AI. Before any AI explanation, the dashboard shows the exact text that would be sent, with Send and Cancel. You can also turn AI explanations off entirely.
Automatic deletion. Choose to delete scan history after 30 days, 90 days or 1 year. A daily job removes anything older.
Two-factor sign-in. Turn on an authenticator-app code for every sign-in. Once it is on, our API refuses sessions that have not passed the second step.
Sign out on all devices with one button.
Remove projects at any time from the dashboard.
Delete your account and data. One button in the dashboard cancels any paid subscription and permanently erases your scans, projects, settings and sign-in account. Stripe keeps its own payment records as the law requires.

How your data is protected

Every connection uses HTTPS, with HSTS and a strict Content-Security-Policy.
Database rules (row-level security) let each account read only its own scans and projects.
Server keys stay on the server; the browser never receives them.
Secret values found in your code are masked before anything is saved.
We never see or store your card number; Stripe handles all payments.
Anonymous scans are rate-limited to prevent abuse; IP addresses are kept for about a day for that purpose only.
Live-site scans need proof of ownership: a DNS TXT record or a file on the site. Nobody can point ShipShield at a site they don't control.

Scan without sending us any code

The local scanner is the same open engine as this site, packaged as one file. It runs on your computer or in your own GitHub Actions runner, makes no network calls, and uploads nothing. It works on private repositories.

In GitHub Actions (add to .github/workflows/shipshield.yml):

name: ShipShield
on: [push, pull_request]
permissions:
  contents: read
  security-events: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Download and verify the scanner
        run: |
          curl -fsSLO https://shipshield.io/cli/shipshield-scan.mjs
          curl -fsSLO https://shipshield.io/cli/shipshield-scan.mjs.sha256
          sha256sum -c shipshield-scan.mjs.sha256
      - name: Scan (code stays on this runner)
        run: node shipshield-scan.mjs . --fail-on high --sarif shipshield.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: shipshield.sarif

On your computer (Node.js 18 or later): download shipshield-scan.mjs, then run node shipshield-scan.mjs path/to/your/app.

Current version 1.0.0. SHA-256: d8ee88246c02e95dd5ab231b2c07f6ccd8a51355153d246fb9f2beb41f1c39f4. The same value is published at /cli/shipshield-scan.mjs.sha256; compare it before you run the file.

Who processes data for us

The companies we rely on, and what each receives, are listed in our Privacy Policy.

Open by design

The scanning engine runs in your browser, so its full source is public at /js/engine.js. You can read every rule we check.

What we don't claim yet

ShipShield has not yet completed an independent penetration test or a SOC 2 audit. We will publish a summary here when we do. A clean score does not guarantee that an app is secure.

Reporting a vulnerability

Found a security problem in ShipShield itself? Email contact@cloudonesoftware.com with "Security" in the subject, or see our security.txt. We aim to acknowledge reports within 5 business days.

Please test only against your own account, never access or change other people's data, and avoid anything that degrades the service, such as load or denial-of-service testing. We will not pursue legal action against good-faith research that follows these rules. [ATTORNEY TO REVIEW safe-harbour wording]