The old holes and the new ones, in a single scan.
ShipShape covers the web classics that still break real apps, and the AI-specific risks the legacy scanners ignore. Here is what it looks for and why each one matters.
Reflected XSS
An attacker slips script into a link or form field and your app echoes it straight back into the page, running in your users' browsers. ShipShape sends crafted inputs and watches whether they come back live, so you catch the hole before it hijacks a session.
Broken Access Control / IDOR
This is the number one risk on the OWASP Top 10. It is what lets one user change an ID in a URL and read another user's data, the same class of bug that exposed private messages in more than one 2025 vibe-coded app. ShipShape probes whether your app actually enforces who is allowed to see what.
Exposed Secrets
API keys, tokens, and credentials leaking through your app are a direct line into your backend, and AI-generated code leaks them constantly. ShipShape checks the surfaces an attacker can reach for secrets that should never have been exposed.
Prompt Injection
This is the top risk on the OWASP LLM Top 10. A malicious input talks your model into ignoring its instructions, leaking data, or misusing its tools. ShipShape actively feeds your LLM injection attempts to see whether it can be talked out of its guardrails.
LLM Data Disclosure
Sensitive information disclosure is the number two risk on the OWASP LLM Top 10, and it is what happens when your model reveals system prompts, private context, or data it should keep locked down. ShipShape's prompt-injection probes are aimed squarely at this class, testing whether your model can be pushed into saying what it should not.
A growing library
The attack surface keeps moving, so the test set does too. Today ShipShape runs live probes for reflected XSS, broken access control, exposed secrets, and prompt injection, and the checklist grows as new OWASP and LLM risks earn a place on it.
Live today: reflected XSS, broken access control / IDOR, exposed secrets, and LLM prompt injection, plus ownership verification, a plain-English report, downloadable report and findings files, and a “Scanned by ShipShape” badge. New probe classes are added over time.
Point it at an app you own and watch it work.
The built-in demo runs with no signup. See a real report in about a minute.