Last updated October 16, 2026
These Terms of Service ("Terms") govern your use of ShipLatch, including the website at shiplatch.com, the free scanner, emailed reports, the Fix Pack, and Stay Locked monitoring (together, the "Service"). The Service is operated by JTA Ventures, LLC, a North Carolina limited liability company doing business as ShipLatch ("ShipLatch", "we", "us"). By using the Service you agree to these Terms. If you do not agree, do not use the Service.
/.env and /.git/HEAD. We look for exposed secrets, missing security headers, and signs of which app builder was used. We do not log in, submit forms, guess passwords, or attempt to exploit anything. We refuse IP addresses and localhost, and we limit scans to 20 per IP address per hour./.well-known/shiplatch.txt, or a DNS TXT record), we can run additional read-only checks. These include a Supabase row-level-security probe that requests zero rows (limit=0) and reads only the row count the server reports, and checks of Firebase security rules. We do not read, copy, or store your application's data.You must be at least 18 years old, or the age of majority where you live, and able to form a binding contract. If you use the Service for a company, you confirm that you are allowed to accept these Terms for it, and "you" includes that company.
You may only submit URLs for sites and applications that you own or that you have explicit permission to test. By starting a scan you confirm that you have that authority. Even passive requests can be unwelcome to a site's owner, and some laws restrict unauthorized security testing. You are solely responsible for having permission. The deep scan is only available after ownership verification, and you must not try to get around that verification.
You agree not to:
We may refuse, limit, or stop any scan, and suspend or end your access, at any time if we believe you have broken these Terms or to protect the Service, a site owner, or anyone else. If you operate a site and want us to stop scanning it, email hello@shiplatch.com.
A scan shows what our checks could see at the moment it ran. ShipLatch is an automated tool. It is not a penetration test, a security audit, a code review, or a compliance assessment (for example SOC 2, ISO 27001, PCI DSS, HIPAA, or GDPR). It may miss issues (false negatives) and may flag things that are not real problems (false positives). A good grade does not mean your app is secure, and your app can change after a scan. Badges such as "Latched" reflect a past scan result only and are not a certification.
Reports include suggested fixes and prompts you can paste into an AI coding tool. These are suggestions only. You decide whether to use them, and you are responsible for reviewing, testing, and backing up before you change your code, database rules, keys, or settings. We are not responsible for changes you or your tools make. If a key or secret has been exposed, you should rotate it with the provider; hiding it is not enough.
You keep all rights to your site and data. You give us permission to fetch the URLs you submit and to process the results to provide the Service. We may use aggregated, de-identified scan statistics (for example, "X% of scanned sites lacked a CSP header") to improve the Service and in our content, without identifying you or your site. Our Privacy Policy explains how we handle personal information.
Payments are processed by Stripe. We do not receive or store your full card number. Charges appear on statements as IGNITARA*SHIPLATCH or SHIPLATCH. Prices are in US dollars and do not include taxes, which you are responsible for where they apply.
Stay Locked renews automatically every month and is charged to your payment method until you cancel. You can cancel at any time through the Stripe customer link in your receipt or by emailing hello@shiplatch.com. Cancellation takes effect at the end of the current billing period, and you keep access until then. We will give at least 30 days' notice by email before changing the price of an active subscription, and you can cancel before the change takes effect.
The Service, including our software, scan rules, reports, guides, and branding, belongs to us or our licensors. You may use reports for your own sites and share them with people who help you fix them. You may not copy or resell the Service itself.
The Service relies on providers such as Cloudflare (hosting), Stripe (payments), and Resend (email delivery), and checks third-party platforms such as Supabase and Firebase. We are not responsible for those services, and their own terms apply to your use of them.
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE". TO THE FULLEST EXTENT ALLOWED BY LAW, WE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, AND ACCURACY. WE DO NOT WARRANT THAT THE SERVICE WILL FIND EVERY VULNERABILITY, BE ERROR-FREE OR UNINTERRUPTED, OR THAT YOUR SITE WILL BE SECURE.
TO THE FULLEST EXTENT ALLOWED BY LAW, SHIPLATCH AND JTA VENTURES, LLC, AND THEIR MEMBERS, OFFICERS, AND CONTRACTORS, WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, OR GOODWILL, INCLUDING DAMAGES FROM A SECURITY BREACH OF YOUR SITE, EVEN IF WE WERE TOLD THEY WERE POSSIBLE. OUR TOTAL LIABILITY FOR ALL CLAIMS RELATING TO THE SERVICE IS LIMITED TO THE AMOUNT YOU PAID US IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM, OR US$0 IF YOU USED ONLY FREE FEATURES. Some places do not allow certain limits, so some of these may not apply to you.
You agree to defend and indemnify us against claims, losses, and costs (including reasonable attorneys' fees) arising from your misuse of the Service, a scan you ran without authorization, or your breach of these Terms.
These Terms are governed by the laws of the State of North Carolina, without regard to its conflict-of-law rules. Any dispute will be brought only in the state or federal courts located in Wake County, North Carolina, and you and we consent to their jurisdiction. Before filing a claim, please email hello@shiplatch.com so we can try to resolve it informally.
We may change or discontinue features at any time. We may update these Terms. When we do, we will change the "Last updated" date above, and for material changes we will give reasonable notice on the site or by email. Continuing to use the Service after changes take effect means you accept them.
If any part of these Terms cannot be enforced, the rest stays in effect. Our failure to enforce a provision is not a waiver. You may not transfer these Terms without our consent; we may transfer them as part of a merger, sale, or reorganization. These Terms and our Privacy Policy are the entire agreement between you and us about the Service.
JTA Ventures, LLC, doing business as ShipLatch. Email: hello@shiplatch.com