{"id":"sh1pt.com/sh1pt","name":"sh1pt","commands":["sh1pt"],"examples":[{"run":"sh1pt init","does":"Scaffold sh1pt.config.ts in the current project"},{"run":"sh1pt build","does":"Build every enabled target locally"},{"run":"sh1pt ship --dry-run","does":"Simulate publishing the built artifacts to their stores"},{"run":"sh1pt ship status","does":"Show live, pending and in-review state per target"}],"description":"CLI that builds one codebase and ships it to app stores, package registries, CDNs and deploy targets, then promotes it.","homepage":"https://sh1pt.com","repository":"https://github.com/profullstack/sh1pt","license":"MIT","agentic":true,"latest_version":"0.3.7","vendor":"Profullstack","install":"curl -fsSL https://sh1pt.com/install.sh | sh","publisher":"profullstack","npm":"@profullstack/sh1pt","w3bs":"w3bs install sh1pt.com/sh1pt","scan":{"status":"passed","scanner":"threatcrush 0.13.30","filesScanned":3996,"summary":{"critical":0,"high":2,"medium":18,"low":35,"info":0},"malware":0,"truncated":false,"version":"0.3.7","sources":{"installer":"https://sh1pt.com/install.sh","installerSha256":"faadf07002f4ca2d8e667e36caeb83f8ca6fb8a8e0717dcabfd0460bdedab502","repository":"github.com/profullstack/sh1pt"},"notes":[],"scannedAt":"2026-11-01T22:56:41.604Z","findings":[{"ruleId":"js-host-header-trust","title":"URL built from the Host header","severity":"high","category":"code","cwe":"CWE-346","file":"source/packages/bots/wechat/src/index.ts","line":405,"malware":false},{"ruleId":"js-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/sites/sh1pt.com/public/sw.js","line":21,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/actions-fleet-core/src/action-pack/schema.ts","line":3,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/core/src/setup-helpers.ts","line":583,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/migrate/src/engines/mysql.ts","line":133,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/migrate/src/engines/postgres.ts","line":276,"malware":false},{"ruleId":"sql-template-interpolation","title":"SQL built from a template literal or f-string","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/migrate/src/transforms.ts","line":178,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/policy/src/rules/bundle-id.ts","line":3,"malware":false},{"ruleId":"sql-string-concatenation","title":"SQL assembled by concatenation or interpolation","severity":"medium","category":"code","cwe":"CWE-89","file":"source/packages/targets/deploy-wordpress/src/index.ts","line":154,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/targets/desktop-linux/src/index.ts","line":19,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/targets/desktop-mac/src/index.ts","line":15,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/targets/desktop-steamos/src/index.ts","line":28,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/targets/mobile-android/src/index.ts","line":9,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/targets/mobile-ios/src/index.ts","line":11,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/targets/tv-androidtv/src/index.ts","line":14,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/targets/tv-firetv/src/index.ts","line":13,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/targets/tv-tvos/src/index.ts","line":14,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/packages/targets/tv-webos/src/index.ts","line":26,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/sites/sh1pt.com/app/blog/[slug]/page.tsx","line":88,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/sites/sh1pt.com/app/components/PitFooter.tsx","line":17,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/affiliates/skimlinks/src/index.test.ts","line":25,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/affiliates/skimlinks/src/index.test.ts","line":71,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/affiliates/sovrn/src/index.ts","line":28,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/agent-providers/opencode/src/__tests__/opencode.test.ts","line":99,"malware":false},{"ruleId":"js-nosql-injection","title":"NoSQL query built from request data","severity":"low","category":"code","cwe":"CWE-943","file":"source/packages/ai/amazon-bedrock/src/index.test.ts","line":121,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/ai/amazon-bedrock/src/index.ts","line":9,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/ai/amazon-bedrock/src/index.ts","line":10,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/ai/amazon-bedrock/src/index.ts","line":11,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/bridges/matrix/src/index.ts","line":58,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/bridges/matrix/src/index.ts","line":59,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/bridges/slack/src/index.test.ts","line":259,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/captcha/captchasolver/src/index.ts","line":34,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/cli/src/commands/secrets.ts","line":189,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/cloud/linode/src/index.ts","line":15,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/migrate/src/platforms/index.test.ts","line":116,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/observability/sentry/src/index.ts","line":15,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/outreach/producthunt/src/index.ts","line":103,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/promo/posthog/src/index.ts","line":23,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/scanners/threatcrush/test/scan-output.txt","line":35,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/scanners/threatcrush/test/scan-output.txt","line":40,"malware":false},{"ruleId":"secret-database-url","title":"Database URL with credentials","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/scanners/threatcrush/test/scan-output.txt","line":54,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/security/snyk/src/index.ts","line":26,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/social/hashnode/src/index.ts","line":4,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/social/linkedin/src/index.ts","line":3,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/social/linkedin/src/index.ts","line":4,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/social/medium/src/index.ts","line":4,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/social/snapchat/src/index.ts","line":5,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/social/tiktok/src/index.ts","line":5,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/targets/plugin-vscode/src/index.test.ts","line":115,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/targets/registry-ans/src/index.test.ts","line":79,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/targets/registry-ans/src/index.ts","line":49,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/targets/sdk-pypi/src/index.test.ts","line":49,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/vcs/gitlab/src/index.test.ts","line":96,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/sites/sh1pt.com/supabase/config.toml","line":303,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/sites/sh1pt.com/supabase/config.toml","line":335,"malware":false}]}}