What we promise, and what we don't.

The one rule

Only scan property you own or have written permission to test. This is the rule everything else rests on, and breaking it may be a criminal offence where you live regardless of what we allow. See our Acceptable Use policy for the detail.

What ShipShape is

ShipShape is an automated security scanner. It tests a defined list of vulnerability classes against a web app and reports what it found, in plain English, with a suggested fix.

It is a tool, not a service performed by a person, and not an audit.

What a clean result does and does not mean

ShipShape is NOT a certification. A scan that finds nothing means the specific checks we ran did not find anything at the moment they ran. It is not a statement that your app is secure.

Every report lists the classes we tested and, separately, the classes we could not test. Read both halves. If a check could not run, the report says so rather than counting it as a pass — that behaviour is deliberate and enforced by automated tests.

It does not cover business logic, your authenticated surface unless you configured that, or anything not on the tested list. Code changes after a scan are not covered by that scan.

What we do to your site

A free instant check sends only plain GET requests — the same traffic your site serves to any browser or search engine. It sends no attack payloads.

A full scan sends real attack payloads and therefore requires you to prove you control the target first, by hosting a file we give you. State-changing requests are off unless you switch them on for that scan.

Scanning consumes resources on your own infrastructure. That is expected and normally trivial, but it is your infrastructure and your bill.

Accounts and payment

Some features require an account, created by confirming an email address. You are responsible for what happens under your account.

Paid plans are billed monthly in advance and you can cancel at any time, effective at the end of the period you have paid for. We do not refund part-months by default. If something we did caused the problem, ask and we will sort it out.

Prices can change. Existing subscribers get notice before a change affects them.

Liability, stated plainly

ShipShape will miss things. Every scanner does. We work hard on accuracy and publish our record, but you must not treat a ShipShape report as proof that your app is safe, and you must not represent it to your own customers as one.

To the fullest extent the law allows, we are not liable for a breach we failed to detect, for damage caused by a scan, or for indirect or consequential loss. Where liability cannot be excluded, it is limited to what you paid us in the preceding twelve months.

Nothing here excludes liability for death, personal injury, or fraud.

Ending it

You can stop using ShipShape whenever you like. We can suspend an account that is scanning property it does not own, attacking our infrastructure, or reselling the service without agreement.

If we shut the service down, we will give notice and let you export your reports first.

Contact

hello@shipshapelabs.com.