Security model

What Shipcheck never does

• Make network requests. There is no telemetry, update check or analytics.
• Upload, copy or send project files anywhere.
• Print the values of environment variables or secrets. Only variable names are shown.
• Modify, delete or commit your source files.
• Run commands through a shell.

What it reads

• Project manifests (package.json, go.mod, Cargo.toml, …) to detect commands and the version.
• Git metadata, through read-only commands: status, rev-parse, symbolic-ref, ls-files and describe.
• Env templates and the dotenv files you configure, to check that variables have values. Values stay in memory and are only used to redact them from output.
• The presence of README, LICENSE and CI files.

What it runs

The tests and build checks run your project's own commands, such as npm test or cargo build --release. These do whatever your scripts do, just as if you ran them yourself. Builds write their normal output (such as dist/).

• Commands are split into arguments and executed directly, without a shell. Pipes, redirects, command chaining, variable expansion and globs in .shipcheck.yml are rejected, not interpreted.
• Commands run in the project directory, with no standard input, and are stopped after a timeout (10 minutes by default).
• Output is captured, not streamed. Only the last 20 lines of a failing command are shown, and only with --verbose. Values of required variables are replaced with ****.
• Config values are validated: env file paths must stay inside the project, and variable names must be valid.

Reporting a vulnerability

Please don't open a public issue for security problems. Follow the process in SECURITY.md.