Repository
Scan findings
Report page
Generative solution to bugs
Landing Page
Github page

ShipSafe AI

ShipSafe is an AI security agent that finds risks, explains their impact, and prepares reviewable code fixes, and pushes it to github before software ships.

Inspiration

In today's world of vibe-coding, one of the most common mistakes junior developers, vibe coders, and small teams face is security pitfalls and issues. Small teams often ship software without a security specialist on board. Existing security tools can also produce long reports without clear priorities or practical fixes. We wanted to make security review easier for developers. ShipSafe turns code and website evidence into a short, actionable plan, helping developers move from detection to correction in one seamless workflow.

What it does

ShipSafe accepts four types of evidence:

Pasted source code
A public GitHub repository or pull request
Locked npm dependencies
A verified website

ShipSafe collects the relevant evidence and creates one prioritized security report. The report includes:

A severity-weighted security score
A short danger summary
Critical, High, Medium, Low, and Informational findings
The location of each problem
A clear explanation of the risk
A recommended correction
Production-readiness notes when they are relevant
Markdown, PDF, and SARIF exports

Fast scans target a visible result in 12 to 15 seconds. If the AI review needs more time, ShipSafe shows a clearly marked preliminary report. The full AI report continues in the background and replaces the preliminary result when it is ready.

The AI functionality

GPT-5.6 is the reasoning layer of ShipSafe. It is not an added chatbot.

ShipSafe first collects bounded security evidence from the selected source. It then sends this evidence to the OpenAI Responses API. GPT-5.6 returns a structured security report with validated fields.

The AI performs four main tasks:

It studies the supplied security evidence.
It ranks the findings by risk.
It explains why each problem matters.
It prepares practical corrections and test guidance.

The Fix Studio extends this workflow. A user can select findings and ask the AI to create one coordinated correction set. The AI produces exact source edits, file explanations, cautions, and suggested regression tests.

ShipSafe does not execute generated code. It does not change the user's local files. The user must review the corrections before download or publication. For two owner-approved demonstration repositories, ShipSafe can create a new branch and a draft pull request. The user must approve this action. ShipSafe blocks writes to all other repositories.

This creates an agent workflow: Collect evidence → reason about risk → generate corrections → request human approval → prepare a safe delivery action

How Codex was used

Codex was the main development partner for ShipSafe during OpenAI Build Week.

I defined the problem, product direction, safety limits, visual identity, and final workflow. Codex helped convert these decisions into a working application.

Codex helped with:

Product and workflow design
React and TypeScript interface development
Express API development
GPT-5.6 Responses API integration
Structured AI output schemas
Security-score and report logic
GitHub repository and pull-request scanning
The AI Fix Studio
Draft pull-request safeguards
Website ownership verification
PDF, Markdown, and SARIF exports
Test creation and fault diagnosis
Responsive interface improvements
Railway deployment configuration
Technical documentation and validation

Codex also helped identify unsafe design choices. We added repository allowlists, exact file matching, short-lived scan context, website verification, server-side secrets, and human approval before GitHub writes. This collaboration reduced the time from concept to runnable MVP. It also allowed us to test several product decisions during the build period.

How we built it

The frontend uses React, TypeScript, Vite, and Tailwind CSS. The backend uses Node.js, TypeScript, and Express. The backend collects evidence from each source type. It limits the number and size of files before analysis. The OpenAI Responses API uses structured output so that the interface receives a predictable report format. ShipSafe sends AI requests with store: false. It keeps API keys on the server. It uses a deterministic scanner when the OpenAI service is not configured or when a quick preliminary result is required. Deep GitHub scans can also inspect locked npm versions through the OSV vulnerability service. Source code is not sent to OSV.

Challenges

The first challenge was safe correction. Generated code must not be applied without review. We created exact text replacements, file-by-file previews, cautions, and explicit approval steps.

The second challenge was source control safety. A GitHub token must never give a judge control of the owner's account. We restricted write access to two approved demonstration repositories. All other repositories remain review-only.

The third challenge was consistent analysis across different source types. Pasted code, repositories, dependencies, and websites provide different forms of evidence. We created one common report structure for all four sources.

Validation

ShipSafe includes three controlled files with fake and intentional security problems. The repeatable deterministic baseline detected all four expected signals in these fixtures. This result verifies the demonstration baseline only. It is not a security certification or a claim of complete vulnerability coverage. The project also includes automated tests, a production build process, demo targets, and a public deployed application.

What we learned

AI security tools need clear limits. A model produces better results when it receives bounded evidence, a defensive instruction, and a strict output schema. We also learned that an agent should not hide uncertainty. ShipSafe labels preliminary results and fallback results. It also keeps important actions under human control. The most useful security agent does more than identify a problem. It explains the risk, prepares the correction, and makes the next safe action clear.