Drydock
Your AI Production Engineer

Is your app ready to ship?

You built it with Lovable, Bolt or v0, and it works. Drydock reads the code the way a production engineer would before letting it near real users — and tells you, in plain language, what would go wrong and what it costs you to leave it.

Public GitHub repos only. The scan runs in the background — you get a link you can come back to.

Free, and no signup. Paste a public repository URL.

What we go looking for

Security risks and project setup gaps worth checking before a demo handles real users. These are examples of the static checks included in the free audit; each report explains what was checked and its limits.

  • Credentials sitting in the code

    AWS keys, GitHub tokens, Stripe live keys, Supabase service keys, bot tokens, private keys — committed to the repository, where anyone who gets the code gets them too.

  • Secrets that slipped into git

    A .env committed by mistake, or a .gitignore that never covered the files holding your keys. Both are quiet until they aren't.

  • Access checks that may be missing

    Inconsistent identity checks between related Python/FastAPI routes, and supported Supabase patterns where row-level security is missing or a service key reaches browser code. These are source signals to verify, not proof that a route is publicly reachable.

  • Risky queries, requests and file access

    Supported patterns for SQL injection, caller-controlled outbound URLs, disabled TLS verification, unsafe deserialization and path traversal. Coverage depends on the language, framework and code structure.

  • No recognised test files

    No test files matching the scanner's supported conventions in the submitted source. Tests maintained elsewhere or in an unrecognised format may be outside this check.

  • Gaps in project setup

    No recognised CI workflow or Dockerfile in the submitted source. These are configuration inventory findings: the app may use another build or deployment process.

The scan is free. The fix is what you pay for.

Free, no account, no card

Static checks for secrets, supported security and access-control patterns, and project setup. The report includes source references, explanations and guidance where available.

A limited model security preview reviews selected code when available. It does not cover every file or the full authentication review. Static results remain available if the preview is unavailable or incomplete. The report shows which model analysis completed and any limits that affected it.

Every report shows findings and verification limits. Neither the free scan nor the deeper review provides a validated readiness score out of 10. Absence of findings does not establish safety.

Paid: the fix, as a pull request

A Fix Pack moves hardcoded credentials into environment variables, removes a committed .env, repairs .gitignore, and opens one pull request against your repository. You read the diff and decide whether to merge it. Bought once, for that one audit.

What a Fix Pack will not touch

Missing tests and missing CI come back as findings with guidance — not as code we wrote for you. Nor would we rewrite a login: doing that to an app we saw for the first time ten seconds ago is how an audit tool locks you out of your own product. And when there is nothing a Fix Pack can safely change, checkout refuses the sale instead of taking your money and reporting that it found nothing to do.

The deeper review

included with a Fix Pack

The full model review adds broader authentication and security analysis to the static checks and limited free preview. It examines selected source code for access-control and injection risks; it does not establish that every file or vulnerability was covered. Model findings are hypotheses to verify, with source references and stated limitations. You can't buy it on its own — buy a Fix Pack and the pull request arrives with a link to the full review of the same code.

How paying works →

See what you get

A sample report, rendered exactly as a real one is. This one is the full review; both tiers show the source and verification limits alongside each finding.

Example reportIllustrative data — not a real audit

6 findings

stack: nextjs

files scanned: 128

2 critical1 high1 medium2 low

6 observations: 6 in source, 0 in tests/examples, 0 informational, 0 with contradicted syntax premises.

Security
Coverage not recorded · 2 unverified findings
Auth
Coverage not recorded · 1 unverified finding
Testing
Coverage not recorded · 1 unverified finding
Deploy
Coverage not recorded · 2 unverified findings
Money & Data
Coverage not recorded
Frontend
Coverage not recorded
Scan record
Scan record
Not recorded for this older audit

File presence is not a deployment check. Submitted files may be excerpted; submission does not prove full review. Model cost is not recorded in this report.

This is a source review. Static signals and model hypotheses need verification. A repeated model claim is not independent evidence.

Runtime behaviour, payment replay and crash recovery, user isolation, and live deployment configuration have not been verified here. Check the cited code and reproduce the claimed consequence in an isolated test environment before applying a suggested fix.

  • A value matches a Stripe live-key format.

    Potential critical impact

    Legacy finding — verification not recorded

    A valid key may allow payment operations within its permissions. A format match does not establish that this key works or which operations it permits.

    Evidence and conditions
    Source check
    Not recorded for this finding; do not assume the cited code was verified.
    Required conditions — not checked
    Not recorded; do not assume the conditions for harm are satisfied.
    Consequence check
    No independent verification recorded.

    Check whether this is a fixture. Rotate an exposed real key and store its replacement in server configuration.

    Hardcoded Stripe live secret key · app/api/checkout/route.ts:12 · sk_live_51Nc…9aQ2

  • An environment configuration file is included in the archive.

    Potential critical impact

    Legacy finding — verification not recorded

    Such files may contain configuration or credentials. File presence alone does not establish that a real secret was exposed.

    Evidence and conditions
    Source check
    Not recorded for this finding; do not assume the cited code was verified.
    Required conditions — not checked
    Not recorded; do not assume the conditions for harm are satisfied.
    Consequence check
    No independent verification recorded.

    Inspect the contents. Keep private environment files outside version control and rotate any exposed real credentials.

    .env committed to the repository · .env:1

  • Your Supabase anon (public) key appears in the code.

    Potential high impact

    Legacy finding — verification not recorded

    This particular key is meant to be public — it ships in every app's front-end by design, so this is informational, not a breach. Seeing it in many committed files usually just means the same key was pasted around; the keys that must stay secret are the service_role key and database passwords, which are NOT flagged here.

    Evidence and conditions
    Source check
    Not recorded for this finding; do not assume the cited code was verified.
    Required conditions — not checked
    Not recorded; do not assume the conditions for harm are satisfied.
    Consequence check
    No independent verification recorded.

    No urgent action needed for the anon key itself. Do confirm your Row Level Security is on, since the anon key relies on it.

    Supabase anon key present in client code · lib/supabaseClient.ts:4 · eyJhbGciOiJI…

  • The project has no automated tests.

    Potential medium impact

    Legacy finding — verification not recorded

    Every change is a blind edit: things that worked yesterday can silently break today, and you'll learn it from your users.

    Evidence and conditions
    Source check
    Not recorded for this finding; do not assume the cited code was verified.
    Required conditions — not checked
    Not recorded; do not assume the conditions for harm are satisfied.
    Consequence check
    No independent verification recorded.

    Start with a few tests for the money paths — signup, login, checkout.

    No automated tests found

  • No Dockerfile was found in the supplied archive.

    Potential low impact

    Legacy finding — verification not recorded

    A Dockerfile is one deployment option. Its absence does not establish that the app cannot run on a server; systemd and managed platforms are other options.

    Evidence and conditions
    Source check
    Not recorded for this finding; do not assume the cited code was verified.
    Required conditions — not checked
    Not recorded; do not assume the conditions for harm are satisfied.
    Consequence check
    No independent verification recorded.

    Review the existing deployment instructions. Add a Dockerfile only if container deployment is needed.Enterprise

    No Dockerfile

  • No automated checks run when the code changes (no CI).

    Potential low impact

    Legacy finding — verification not recorded

    Broken changes reach your live app with nothing in the way.

    Evidence and conditions
    Source check
    Not recorded for this finding; do not assume the cited code was verified.
    Required conditions — not checked
    Not recorded; do not assume the conditions for harm are satisfied.
    Consequence check
    No independent verification recorded.

    Add a simple GitHub Actions workflow that runs the tests on every change.

    No CI workflow