Spaces:
Running
Running
File size: 1,330 Bytes
b83c36e a7db647 b83c36e a7db647 b83c36e a7db647 b83c36e a7db647 b83c36e a7db647 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 | ---
title: ShipCheck
emoji: 🛡️
colorFrom: blue
colorTo: gray
sdk: static
app_file: index.html
pinned: false
license: apache-2.0
short_description: Proves the exploit, fixes it, then re-attacks the fix
---
# ShipCheck — adversarial verification gate for AI-generated code
ShipCheck attacks AI-written code in a sandbox, proves each vulnerability with a real exploit, fixes it, re-attacks the fix, and opens a **draft** PR for a human. It never auto-merges.
This page replays a **recorded real scan** of the `vulnshop` demo app: real scanners (semgrep, gitleaks, osv-scanner, pip-audit), attack plans from NVIDIA Nemotron 3 Ultra on Nebius Token Factory, live HTTP exploits in isolated sandboxes, Tavily CVE grounding, and fixes from Nemotron 3 Super. 4 of 4 planted bugs (SQL injection, command injection, path traversal, reflected XSS) were confirmed, fixed and re-verified.
It is the dashboard's own page with that recording baked in (`scripts/build_static_demo.py`), so it renders exactly what the running app renders. Live scanning is disabled here, because a scan executes submitted code and spends model credits — run ShipCheck locally to scan your own code.
- Source: https://github.com/8bitaditya/Shipcheck- (Apache-2.0)
- Example draft PR opened by ShipCheck: https://github.com/8bitaditya/Shipcheck-/pull/1
|