CanIShip
The Pre-Launch Cargo Inspection Authority for Web Applications
Solo builders ship underdeveloped products and get themselves into trouble.
CanIShip is an automated cargo inspection service for web applications. Paste your URL. Describe what your app does. Receive a structured inspection report with a ShipScore™ and a binary verdict: CLEARED FOR DEPARTURE or HOLD — DEFECTS FOUND.
No SDK. No installation. No credit card. 3 free inspections per month, always.
10 layers. 100+ discrete checks.
Runtime audit + optional source code scanPlaywright navigates every declared flow. Unresponsive controls, dead ends, and broken redirects are logged with screenshot evidence.
Missing loading states, absent error messages, silent failures — friction that does not break the app but breaks the user.
axe-core injection across all pages. Violations are classified by severity with WCAG criterion reference and remediation.
Lighthouse against LCP, CLS, FCP, TBT, INP. Render-blocking resources, unoptimised assets, and Time to Interactive flagged.
OWASP headers audit. Routes accessible without authentication. Sensitive data in source or URL. Mixed content and HTTPS enforcement.
Every internal href crawled. All network responses monitored via Playwright intercept — 4xx/5xx that the UI silently swallows.
Title, meta description, canonical, Open Graph, sitemap.xml, robots.txt — every signal search engines use to index or reject.
Real 375px viewport. Horizontal overflow, unclickable touch targets, missing viewport meta, and layout breaks at WCAG 2.5.5.
AI-powered analysis of the business model itself. Flags fake engagement, platform ToS violations, unregulated regulated industries, and legal grey areas — with an advisory score separate from the ShipScore.
Paste your public GitHub repo URL and Semgrep scans your actual source code — catching hardcoded secrets, SQL injection patterns, insecure crypto, and prototype pollution that a runtime audit cannot see. Code is cloned, scanned, and deleted immediately.
How CanIShip Differs From Other Tools
Standards Referenced
Scope of This Inspection
Functional navigation, WCAG 2.1 AA accessibility, Core Web Vitals, OWASP security headers, broken links, console errors, SEO, mobile readiness at 375px, and AI-powered business risk assessment — ten layers including optional source code SAST scan.
Manual penetration testing, load testing, screen-reader user testing, or auth-gated flows beyond provided test credentials. The business risk score is advisory — it flags grey areas but does not constitute legal advice. For regulatory obligations, supplement with qualified legal review.
Each inspection is a fresh snapshot. Re-run after fixes to measure improvement. Builder and Studio plans retain full history with score differential between runs.
Inspection Tariff
No hidden fees. Cancel any time.Try the inspection process at no cost.
For builders who ship on a regular schedule.
Unlimited inspections. Run on your own infrastructure.
Frequently Asked Questions
A separate advisory score (0–100) that evaluates whether your business model operates in a legally questionable, ethically grey, or platform Terms-of-Service-violating space. It flags categories like fake engagement services, unregulated financial products, and data harvesting. It does not affect your technical ShipScore and does not constitute legal advice.
No. The score is informational only. A flagged category means the business model shares characteristics with areas that attract legal scrutiny in some jurisdictions. It is a prompt to seek qualified legal advice before scaling — not a verdict.
Technical readiness: functional correctness, accessibility (WCAG 2.1 AA), Core Web Vitals, OWASP security headers, broken links, SEO signals, mobile readiness, privacy compliance, and active security probing. It starts at 100 and deductions are applied per finding — the formula is deterministic and Claude never owns the number.
Quick Scan: ~5 minutes. Standard Scan: ~10–15 minutes. Deep Scan: up to 30 minutes. The business risk assessment adds less than 30 seconds to any tier.
Yes. Each inspection is an independent snapshot. Builder and Studio plans retain full history so you can track score progression between runs.
No. CanIShip is an automated pre-launch signal, not a substitute for human QA, manual penetration testing, or regulatory legal review. Think of it as the last automated checkpoint before you invite real users in.
Your cargo does not leave the dock until it passes inspection.
File a manifest. Receive an inspection report. Know what to fix before your users find it.
File Your First Manifest — Free →