ShipWatch vs Lockpick: Live-Site Scanners for Vibe-Coded Apps
Lockpick and ShipWatch both look at your live site from the outside and give you a prompt to fix what they find. Lockpick covers more ground: repos, MCP servers, DNS and email records. ShipWatch does one thing, the live site. Here's the honest side-by-side.
Short answer: Lockpick scans websites, public GitHub repos, skills and MCP servers, and its free Pulse scan includes SPF/DMARC, TLS and DNS, certificate and subdomain records. Its free plan is 5 Pulse scans a month on one site. ShipWatch scans the live site only: leaked keys, .env, .git, four headers and HTTPS, with weekly monitoring from $19/mo.
Last checked October 20, 2026 against lockpick.app, lockpick.app/pricing and ShipWatch's own scanner code. Features change fast; corrections welcome at support@williamtstephens.com.
Two different scopes
Lockpick calls itself antivirus for vibe-coded apps, websites, skills and repos. That's a broad remit: the site, the domain around it, and the code and agent tooling you pull in. ShipWatch is a live-site scanner and nothing else. It reads what a stranger's browser downloads and tells you whether a secret or a config file leaked. Neither scope is wrong. They answer different questions, and you should know which one you're asking.
Feature table
From each vendor's public pages on the date above. "Not listed" means the page didn't say.
| Check | ShipWatch | Lockpick |
|---|---|---|
| Input | Live URL | Live URL; public GitHub repo, skill, plugin, MCP server, npm or PyPI package |
| Free website scan scope | HTML plus up to 25 scripts, /.env, /.git/HEAD, headers, HTTPS | Pulse: homepage and the files it loads, at most 10 requests |
| Secret keys in page and JS | Stripe, OpenAI, Anthropic, AWS, Google, Supabase service_role and sb_secret_ | Yes (example shows a Supabase service_role key) |
| Security headers and TLS | CSP, HSTS, X-Frame-Options, nosniff, HTTPS redirect | Headers and TLS |
| SPF and DMARC | No | Yes, in Pulse |
| DNS, certificate, subdomain records | No | Yes, in Pulse |
| Supabase, Firebase, Convex access rules | No | Deep, after ownership proof |
| API, GraphQL, CORS | No | Deep |
| Weekly re-checks | Solo and Pro, on the dashboard | Free (uses a scan each) and Deep (emailed) |
| Free plan | One-off scans, no signup | 5 Pulse scans a month, 1 site |
| Paid | Solo $19/mo ($190/yr); Pro $49/mo ($490/yr) | Deep $19/mo ($190/yr); Master Key from $49/mo, coming soon |
Where Lockpick does more
- Repos and MCP servers. Paste a public GitHub repo, a skill or an MCP server and Lockpick reads the code without running it, free on every plan. If you install agent tools from strangers, that's a real gap ShipWatch doesn't cover.
- DNS, email and certificates. Missing DMARC lets anyone send mail as your domain; a dangling CNAME can be taken over. Pulse checks both. ShipWatch doesn't.
- Backend rules. Deep checks Supabase, Firebase and Convex access rules once you prove you own the site. ShipWatch doesn't test tables.
- Scheduled checks on the free plan. Lockpick Free includes weekly auto-checks, each using one of the 5 monthly scans.
Where ShipWatch fits
ShipWatch reads your HTML and up to 25 scripts, which matters for apps that split their bundle into many chunks: the key you're worried about may live in chunk 14. It matches known secret formats for Stripe, OpenAI, Anthropic, AWS and Google, plus Supabase service_role JWTs and sb_secret_ keys. It requests /.env and /.git/HEAD, checks CSP, HSTS, X-Frame-Options and nosniff, and confirms HTTPS with a redirect. There's no account wall on the free scan and no monthly scan budget to ration.
Paid plans re-scan weekly and show what changed on your dashboard. ShipWatch doesn't send alert emails at the moment, so the dashboard is where you look.
How to choose
- Only a site to protect? Either works; running both free scans costs you a minute.
- Using MCP servers or third-party skills? Lockpick's free repo and skill check covers something ShipWatch can't.
- Own a custom domain that sends email? Check SPF and DMARC with Lockpick or your DNS host.
- Use Supabase? Test your tables, by hand with our Supabase RLS checklist or with a tool that does it after ownership proof.
Keep watching weekly: Solo $19/mo ($190/yr) or Pro $49/mo ($490/yr), with results on your dashboard. Compare plans.
What the free scan checks here (and what it doesn't)
ShipWatch checks secret key patterns in your HTML and up to 25 scripts, Supabase service_role and sb_secret_ keys, /.env, /.git/HEAD, CSP, HSTS, X-Frame-Options, nosniff and HTTPS. It does not scan repos or MCP servers, does not check DNS, email or certificate records, and does not test Supabase tables. See also ShipWatch vs LeakPatrol and the full scanner comparison.
FAQ
- Does Lockpick scan things ShipWatch can't?
- Yes. Lockpick reads public GitHub repos, skills, plugins and MCP servers, and npm or PyPI packages, and checks email and DNS records such as SPF, DMARC and subdomain takeover. ShipWatch scans only your live site.
- How do the free plans compare?
- Lockpick Free gives 5 Pulse scans a month on one site, with weekly auto-checks that each use a scan. ShipWatch's one-off scan is free; weekly monitoring needs Solo ($19/mo) or Pro ($49/mo).
- Do both tools send email?
- Lockpick's Deep plan lists weekly auto-checks emailed to you. ShipWatch shows weekly results on your dashboard and doesn't send alert emails right now.