Security

How scans work

• Owners only. We scan a live app only after you add a verification tag to it, and we check the tag again on every scan. There is no way to scan an app you don't control.
• Read-only. The standard scan only sends GET and HEAD requests, the same as a visitor's browser. The cookie-consent check also opens your app once in a real browser from Frankfurt, like one visitor. It never fills in forms or signs in, and the only click is your cookie banner's Reject button. We never write, change or delete anything in your app or database.
• Minimal evidence. When we prove a table is open, we read at most a few rows and show them only to you.
• Gentle. Requests are spaced out and capped per scan. If your host starts challenging us, we stop.
• Code stays on your machine. The CLI and MCP server run locally. Your code and findings never reach us; only an anonymous usage count does, and SHIPPABLE_TELEMETRY=0 turns that off.

Your data

• What we store. Your email, the apps you save and their reports. IP addresses are stored only as salted, one-way hashes. Details in the privacy policy.
• Encryption. Every connection uses HTTPS (HSTS on). The database is encrypted at rest by our provider.
• Retention. Saved reports are deleted after 12 months, and other records on a fixed schedule listed in the privacy policy.
• Deletion. You can delete your account from My apps at any time. Everything saved with it is deleted at once.
• No selling, no training. We never sell data, and we never use scan results to train AI models.

Access and operations

• Sign-in is passwordless (one-time email links), so there are no Shippable passwords to leak.
• Only the founder has production access. Admin pages are restricted to an allowlist and hidden from everyone else.
• Secrets live in our host's encrypted environment settings, never in code.
• Card payments go straight to Stripe. We never see or store card numbers.
• Shippable scans itself with Shippable, and dependencies are checked against OSV.

Certifications

Shippable itself isn't SOC 2 or ISO 27001 certified yet. It runs on providers that are: Vercel and Neon hold SOC 2 Type II reports, and Stripe is PCI DSS Level 1. We're happy to fill in your security questionnaire, just email us.

Subprocessors

• Vercel: Hosting and serverless functions (United States)
• Neon: Database (accounts, saved apps, reports) (United States)
• Resend: Sign-in links and watch alerts by email (United States)
• PostHog: Cookieless product analytics (United States)
• Stripe: Payments, once paid features open (United States)
• OSV (Google): Public vulnerability lookups for library names and versions (United States)

We'll update this list before adding a new subprocessor that handles customer data.

Incidents

If a breach affects your data, we'll tell you by email without undue delay, and within 72 hours of confirming it, with what happened, what data was involved and what we're doing about it.

Report a vulnerability

Found a security issue in Shippable? Email hello@shippable.dev with the details. We'll reply within 3 business days and won't take legal action against good-faith research that avoids harming users or their data. A data processing agreement (DPA) is available on request.