SecurityCommercialFreeActiveAuthor-tested· beginner · ~10 min setup

Review Seeded Security Findings with ShipCheck

Manually scan a synthetic public repository and review secret, environment-file and dependency findings.

FlowStacks verification by Shilpa Mitra·Submitted by @Tweaked19820· verified today· v1.0.0

Run this workflow

See exactly what it produces before you build it.

Build this with your agent

One copy-paste hands Claude Code, Codex, or Cursor the full recipe, steps included, nothing to fetch.

Intended Use

Learn how to interpret a hosted scanner's report using the submitter's deliberately insecure, synthetic public demo. FlowStacks manually reproduced the four seeded finding categories on 4 November 2026. A pass means those demo problems were detected; it does not mean the repository is safe.

Not for

  • Security certification, an exhaustive audit or proof of no vulnerabilities
  • Unattended CI, private-repository permission checks or mass scanning
  • Testing real credentials, executing the vulnerable demo or installing its dependencies
  • Validating history-only secret detection, general false-positive rates or backend isolation/deletion claims

The Stack

ShipCheckby Jaco Pelser

Tested Against

ShipCheck public website, manual run on 2026-11-04Tweaked19820/shipcheck-demo-webafterai@9e8c5cfe645d5899ea1dd6dbd321ee2048674f8dReport 9d59bc2f-3997-4a2a-9029-cdc1a14e90b7; scanner/advisory versions unavailable

Side effects & data flow

Network
Submit the public demo URL to https://vibeshipcheck.com; ShipCheck retrieves its public files/history and generates a hosted report, The vendor says masked findings are sent to xAI for explanations; FlowStacks did not verify backend processing
Writes
A hosted report is created; optionally save a masked result locally
Credentials
none required

Data privacy

  • ShipCheck / REEFERTECHPRO LIMITED and its stated providers, including xAI for report text ← Submitted public repository URL, public source/history and derived findings; use only the synthetic demo here (retention: Vendor says clones are deleted after analysis and masked reports retained; these backend properties were not independently verified. Treat report links as shareable and do not submit confidential content.)

Prerequisites

  • A browser; the free public-repository scan needs no account, API key or purchase
  • Use the explicitly submitted synthetic demo: https://github.com/Tweaked19820/shipcheck-demo-webafterai
  • Before each rerun confirm demo HEAD is 9e8c5cfe645d5899ea1dd6dbd321ee2048674f8d; the website scans the default branch, not a pinned revision
  • Compare with the dated source expectations: https://github.com/Tweaked19820/shipcheck-demo-webafterai/blob/9e8c5cfe645d5899ea1dd6dbd321ee2048674f8d/EXPECTED-FINDINGS.md
  • Only submit repositories you own or have permission to assess; terms: https://vibeshipcheck.com/terms and privacy: https://vibeshipcheck.com/privacy

Steps

  1. 1

    Inspect the synthetic fixture without running it

    Open the demo and its EXPECTED-FINDINGS.md on GitHub. Confirm the default-branch revision matches the tested commit before and after the scan. Inspect the fake Stripe-shaped token at .env:3, the committed .env, lodash@4.17.15 in package-lock.json, and the absent root .gitignore. AWS documentation-example values in src/config.js are deliberately not expected as secret findings. Do not install dependencies, run the application or test any token. The demo has no explicit license; this recipe links to it and does not redistribute its files.

  2. 2

    Run one free scan in the browser

    Open https://vibeshipcheck.com, paste https://github.com/Tweaked19820/shipcheck-demo-webafterai in GitHub repository URL, and select Scan my repo. Wait for completion; reload the report if the progress screen stops updating. An error or unfinished scan is inconclusive, not a pass. No GitHub connection, private repository, email signup or Fix Pack purchase is needed.

  3. 3

    Review the structured evidence, then the explanation

    Require all four categories: a current-file Stripe token pattern at .env:3, committed .env, known-vulnerable lodash@4.17.15, and missing .gitignore. Confirm the AWS documentation examples are absent from the reported secret findings. The fake Stripe-shaped value is a seeded detection target, not evidence of a working leaked key. Read AI-written recommendations critically and never paste a real secret into a shared result. A missing category requires investigation before marking this manual check passed.

  4. 4

    Record a dated result and its limits

    Save the report URL, date, demo revision before/after, observed categories, score and advisory evidence. On 4 November 2026 FlowStacks observed 60/100, four categories and five lodash advisories (three high, two moderate). The submitter's 23 October example recorded 62/100 and six advisories; live scores, severity summaries, advisory sets and prose can change. Do not freeze those numbers as a permanent pass rule. The demo has no history-only secret or independent clean control. Private GitHub access, paid fixes, actual credential validity, backend security/deletion and broader detection accuracy remain outside this check. The separately documented ShipCheck Action is not installed, audited or verified by this recipe.

Eval, 1 fixture

Last passed: verified today
  • manual-seeded-finding-categoriesrubrictimeout 600s · max $0

    Judge: manual-review-no-model Rubric: A human confirms a completed scan of the inspected demo revision, all four seeded finding categories, .env:3 Stripe-pattern evidence, lodash@4.17.15 dependency evidence, and no reported AWS documentation-example secret. Record score/advisory details by date without requiring a fixed number. Errors, incomplete scans or missing categories are not a pass. This is not a repository security verdict.

Results

Manual check passed on 4 November 2026: all four seeded categories were present, with a 60/100 risk score and five lodash advisories (three high, two moderate). The AWS documentation examples were not reported as secrets. This author-tested recipe is excluded from automated CI; neither the intentionally insecure demo nor ShipCheck is certified secure.

Did this work for you?

Our CI checks the setup runs. You tell us if the whole thing worked. Tell us straight.

Related workflows

Liked this workflow?

Get new verified workflows in WebAfterAI, three issues a week (Tue, Thu, Sat).