Should I use Cloudflare's security-audit skill or Shippable?
Use both if you can. Both read your code, but they do different jobs. Cloudflare's skill is a long, deep audit of the source on any stack. Shippable is a fast check of your code and your live app for the leaks AI-built apps ship most, with proof from the running app.
Why
Cloudflare's security-audit skill (free and open source, github.com/cloudflare/security-audit-skill) turns a coding agent like Claude Code into a code auditor. It maps the codebase, sends several agents hunting for bugs, has a fresh agent try to disprove each one, and writes a report that sorts results into confirmed, needs validation and rejected. It's thorough and works on any stack, but a full run takes a while, uses a lot of model tokens, and for running the app's code safely it expects a sandbox you set up yourself.
Shippable reads your code too. In your project folder (the CLI, or the MCP server in your agent) it checks Supabase migrations and policies, edge functions that don't check the caller, unsigned payment webhooks, secrets in code and a full dependency audit in seconds. Then shippable_review_code gives your agent a checklist for what patterns can't catch, like plan limits enforced only in the frontend, using the same rule: try to disprove each issue before reporting it. It's built for the problems AI builders leave behind, not every bug class Cloudflare's skill hunts.
What a source audit can't see is the deployed app: a Supabase table whose production RLS doesn't match your migrations, a secret key that ended up in the built JavaScript, a .env file or source map your host serves, missing headers, trackers that fire before the cookie banner. Shippable checks the running app with only what a visitor has, read-only, shows what came back for every finding with a fix to paste into your AI tool, and can re-check after every deploy.
How to check
- Before launch, scan your live URL (or localhost) with Shippable and fix every critical and high finding.
- For a deeper look at the code, run Cloudflare's security-audit skill in your coding agent. Run it more than once: in Cloudflare's own tests one run found about half of what repeated runs found.
- After fixing, scan again to confirm the leak is gone from the live app, not just from the code.
Check your app
Your first app is free, and it is read-only. You prove the app is yours with a one-line tag first.