Ship Check
It worked fine in dev.
That's the problem.
Paste a public GitHub repo. Get it scored against 62 production footguns that pass your build and break your deploy — no signup for the score.
Every check comes from something that actually broke in production. New ones go out to The Footgun List as they're found.
Public repos only. No signup for the score. Nothing is written to your repo, and there's no GitHub App to install.
Ready. 62 checks available.
The build passes. The deploy succeeds. It's still broken.
Every check here is for something that fails silently — no error, no warning, no red build. You find out from a user, or you find out at midnight on a Friday.
Nothing lints the config that takes you down.
Your linter reads your source. It does not read your build script, your CSP header, your vercel.json, or the size of your favicon. That's where the footguns live.
The checklist you'd otherwise write after the incident.
Every one of the 62 checks traces to a real production failure — something that actually broke and had to be diagnosed. Not style opinions.
The Footgun List
One deploy that broke, and why — every time we find a new one.
Not a tips newsletter. Each issue is a single real failure: what shipped, what silently didn't work, how long it took to find, and the exact fix. When it becomes a repeatable check it gets added to the scanner and you get it first.
- New checks as they're written, with the incident behind each
- Post-mortems from a fleet of live apps — the Prisma client that shipped stale, the CSP that killed every handler with no error
- No cadence promises. It goes out when something breaks, not weekly
What it actually checks
The whole rule list is public. You shouldn't have to hand over an email to find out what a scanner even looks for.
What we do with your repo, precisely
- Public repos only.Read through GitHub's public API — the same data anyone can already see.
- No GitHub App to install. No OAuth prompt, no write scope, nothing added to your account.
- Your code isn't stored. Files are read in memory to run the checks. We keep the findings and the score — not your source.
- The email is for the long tail, not the score. Score and the three worst findings render before any email field exists.