FAQ

The questions people actually ask, answered without hedging.

Do I have to give you an email?

No. The score and your three worst findings — with the fixes — render before any email field exists on the page, and there's a copy-as-markdown button so you can take them with you. The email only unlocks the remaining findings.

What are you going to do with my email address?

Send you the full report, then occasional emails about shipping web apps. It is never sold, never shared, and never handed to a data broker. One click unsubscribes, no login and no confirmation step.

Will you sign me up to something I didn't ask for?

You can't be added by accident. The consent box is unchecked by default, and an address only reaches the list after you click a link we email to it. If you never click, nothing is ever sent to you again.

Why do you need me to click a confirmation link?

It proves the address is real and that its owner wanted this — otherwise anyone could sign up anyone else. It also keeps the list clean, which is the only reason mail from us reaches an inbox at all.

Do you store my code?

No. Files are fetched into memory, the checks run, and the files are discarded. What's kept is the findings, the score, and the repo name — enough to rebuild your report, not enough to reconstruct your source.

Do I have to install a GitHub App?

No. There's no OAuth prompt and no app to authorise. Ship Check reads public repositories through GitHub's public API — the same data any logged-out visitor can see.

Can it scan a private repo?

No, and that's deliberate. Private access needs broad OAuth scopes, and holding those for a free tool is a liability for both of us.

I scored 100. Am I safe to deploy?

It means none of the 30 footguns we check for fired. It is not a clean bill of health — it can't see your business logic, your load behaviour, or bugs nobody has catalogued yet.

One of your findings is wrong.

Then we'd like to know — a false positive costs us more than a missed finding does. Mail ceo@theappmakerpro.com with the repo and the rule id and we'll either fix the rule or explain why it fired.

Where do the checks come from?

Real production failures across a fleet of shipped apps — the build that passed and deployed a stale Prisma client, the CSP that silently killed every inline handler, the favicon that tanked LCP. If a check can't point at an incident, it isn't in the list.

Is it open source?

The rule list is published in full at /checks, including every rule id and severity. The hosted scanner isn't open source today.

How do I delete my data?

Unsubscribing removes you from all sending immediately. For full erasure of your subscriber record, mail ceo@theappmakerpro.com and it's deleted within 30 days, per GDPR Art. 17.