checkship-cli

Security scanner for AI-built apps. Check before you ship.

$ checkship scan

CheckShip v0.1.0

Scanning myapp...

CRITICAL (1)
  ✗ OpenAI API Key found
    src/config.js:12
    sk-pr********************3d

HIGH (2)
  ✗ SQL query with string concatenation
    src/db.js:45
    query("SELECT * FROM users WHERE id = " + id...
  ✗ Sensitive route /api/admin may lack auth
    src/routes/admin.js:8
    router.get('/api/admin', async (req, res) =>...

─────────────────────────────────────────
1 critical · 2 high · 0 medium · 0 low

Full explanations + fixes: checkship.dev

Install

# Run directly with npx
npx checkship-cli scan

# Or install globally
npm install -g checkship-cli
checkship scan

Usage

# Scan current directory
checkship scan

# Scan specific path
checkship scan ./my-app

# Output as JSON (for CI/scripting)
checkship scan --format=json

# Output as SARIF (for GitHub Code Scanning)
checkship scan --format=sarif > results.sarif

# Only show high and critical issues
checkship scan --severity=high

# CI mode (exits with code 1 if high/critical issues found)
checkship scan --ci

# Run specific checks only
checkship scan --check secrets/hardcoded --check sql/injection

# List all available checks
checkship list-checks

# Create config file
checkship init

Security Checks

| Check | Severity | What it finds | |-------|----------|---------------| | secrets/hardcoded | Critical | API keys, tokens, passwords, connection strings in code | | deps/vulnerabilities | Critical | Known CVEs in npm/pip dependencies | | sql/injection | High | SQL queries built with string concatenation | | auth/missing-middleware | High | Sensitive routes (/admin, /users) without auth middleware | | auth/plain-passwords | High | Passwords stored or compared without hashing | | config/cors-permissive | High | CORS configured to allow any origin | | info/stack-traces | High | Error handlers exposing stack traces to users | | ai/prompt-injection | High | User input passed directly to AI prompts |

Configuration

Create a .checkshiprc.json in your project root:

{
  "ignore": [
    "test/**",
    "**/*.test.ts",
    "**/*.spec.ts"
  ],
  "severity": "high",
  "exclude": ["deps/vulnerabilities"]
}

Or run checkship init to generate one.

CI Integration

GitHub Actions

name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run CheckShip
        run: npx checkship-cli scan --ci

With GitHub Code Scanning (SARIF)

name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4

      - name: Run CheckShip
        run: npx checkship-cli scan --format=sarif > results.sarif
        continue-on-error: true

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

Exit Codes

| Code | Meaning | |------|---------| | 0 | No issues found (or none above threshold) | | 1 | High or critical issues found (in --ci mode) |

Supported Languages

• JavaScript/TypeScript - Full support (secrets, SQL injection, auth, passwords, npm audit)
• Python - Partial support (secrets, pip audit)

What's Next

This is the open source CLI. For friendly explanations, fix instructions, and shareable reports, check out checkship.dev.

License

MIT