Skip to content
shipcheck

All 30 checks

Every rule, in full, with no email required. Each one traces to a failure that actually happened in production — if a check can't point at a real incident, it doesn't belong in the list.

Checks are skipped when they don't apply. A repo with no Prisma never runs the Prisma rules, so "30checks" is the catalogue size — your report shows how many actually ran against your code.

build7

Things that make the build produce the wrong artifact, or make it fail on a clean CI machine after passing on yours.

  • critical

    Build script doesn't run `prisma generate`

    build.prisma-generate

  • critical

    ESM relative imports missing `.js` extensions

    build.esm-js-extensions

  • high

    tsconfig `extends` points above the deploy root

    build.tsconfig-extends-above-root

  • high

    `vercel.json` sets buildCommand without outputDirectory

    build.vercel-static-output-dir

  • medium

    No build script defined

    build.no-build-script

  • high

    No lockfile committed

    build.no-lockfile

  • medium

    Build configured to ignore type or lint errors

    build.ignores-type-errors

security11

Credentials in git, headers that don't restrict what you think they restrict, and input paths that reach a database.

  • critical

    Live credential committed to the repo

    security.committed-secret

  • critical

    `.env` file committed

    security.env-committed

  • medium

    .gitignore doesn't cover .env files

    security.gitignore-env

  • high

    CSP omits `default-src`

    security.csp-default-src

  • high

    Inline event handlers will be silently killed by CSP

    security.csp-inline-handlers

  • medium

    No startup validation of required env vars

    security.no-env-validation

  • high

    Clerk server import with no configured keys

    security.clerk-keyless

  • medium

    API routes with no rate limiting

    security.no-rate-limit

  • medium

    dangerouslySetInnerHTML on possibly-untrusted content

    security.dangerous-html

  • critical

    SQL built by string concatenation

    security.sql-concat

  • high

    CORS allows any origin with credentials

    security.cors-wildcard

deploy3

Platform-specific traps — environment variable names, migration ordering, and config that only bites once it's live.

  • high

    Reading UPSTASH_REDIS_REST_* on Vercel

    deploy.upstash-env-prefix

  • low

    No Node version pinned

    deploy.no-node-version

  • medium

    Prisma schema with no migrations directory

    deploy.prisma-no-migrations

correctness4

Logic that works until a specific sequence happens: dropped webhook events, killed background work, schema rejections.

  • high

    Webhook marked processed before the handler succeeds

    deploy.webhook-idempotency-order

  • low

    Synchronous setState inside useEffect

    correctness.setstate-in-effect

  • medium

    z.optional() in an OpenAI structured-output schema

    correctness.openai-strict-optional

  • medium

    Un-awaited async work in a serverless handler

    correctness.floating-promise-serverless

performance3

Assets and settings that quietly cost you Core Web Vitals, usually the ones nothing in your toolchain looks at.

  • medium

    `app/icon.png` is large enough to hurt LCP

    perf.app-icon-size

  • medium

    Next.js image optimization disabled globally

    perf.images-unoptimized

  • low

    No cache headers configured

    perf.no-cache-headers

compliance2

Legal obligations that attach the moment you collect an email address or send a commercial message.

  • medium

    Collects email but has no privacy policy page

    compliance.no-privacy-policy

  • high

    Sends email with no unsubscribe path

    compliance.no-unsubscribe

Think a check is wrong?

A false positive costs more trust than a missed finding earns, so we'd genuinely rather hear about it. Mail ceo@theappmakerpro.com with the repo and the rule id.

Run it on your repo →