Ship Check
It worked fine in dev.
That's the problem.
Paste a public GitHub repo. Get it scored against 30 production footguns that pass your build and break your deploy — no signup for the score.
Public repos only. No signup for the score. Nothing is written to your repo, and there's no GitHub App to install.
Ready. 30 checks available.
The build passes. The deploy succeeds. It's still broken.
Every check here is for something that fails silently — no error, no warning, no red build. You find out from a user, or you find out at midnight on a Friday.
Nothing lints the config that takes you down.
Your linter reads your source. It does not read your build script, your CSP header, your vercel.json, or the size of your favicon. That's where the footguns live.
The checklist you'd otherwise write after the incident.
Every one of the 30 checks traces to a real production failure — something that actually broke and had to be diagnosed. Not style opinions.
What it actually checks
The whole rule list is public. You shouldn't have to hand over an email to find out what a scanner even looks for.
What we do with your repo, precisely
- Public repos only.Read through GitHub's public API — the same data anyone can already see.
- No GitHub App to install. No OAuth prompt, no write scope, nothing added to your account.
- Your code isn't stored. Files are read in memory to run the checks. We keep the findings and the score — not your source.
- The email is for the long tail, not the score. Score and the three worst findings render before any email field exists.