// Auto-fix security issues — remediate hardcoded secrets and common vulnerabilities (TLS bypass, debug mode, XSS, shell injection, Docker :latest). Use when the user wants to automatically fix security findings.
Install ship-safe as real-time Claude Code hooks — blocks secrets and dangerous commands before they land on disk. Use when the user wants automatic security scanning on every file write or bash command.
Manage your security baseline — accept current findings as known debt, then only report new regressions on future scans. Use when the user wants to adopt security scanning incrementally or suppress existing findings.
Run Ship Safe in CI mode — compact output, exit codes, SARIF generation. Use when the user wants to set up CI/CD security gates or test their pipeline configuration.
Run a deep security audit with LLM-powered taint analysis — regex scan nominates findings, then an LLM verifies taint reachability and exploitability. Use when the user wants thorough, high-confidence results with fewer false positives.
Run a multi-agent red team scan — 16 specialized security agents scan for 80+ attack classes including injection, auth bypass, SSRF, supply chain, Supabase RLS, MCP security, agentic AI, RAG poisoning, PII compliance, and more. Use when the user wants a deep security analysis beyond just secrets.
Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials.
| name | ship-safe-fix |
| description | Auto-fix security issues — remediate hardcoded secrets and common vulnerabilities (TLS bypass, debug mode, XSS, shell injection, Docker :latest). Use when the user wants to automatically fix security findings. |
| argument-hint | [path] [--all] [--dry-run] |
You are using Ship Safe's remediation engine to automatically fix security issues in this project.
Always start with a dry run to show what will change:
npx ship-safe@latest remediate $ARGUMENTS --dry-run 2>&1
If $ARGUMENTS is empty, default to . --all (fix both secrets and agent findings):
npx ship-safe@latest remediate . --all --dry-run 2>&1
Flags:
--all flag → only fixes hardcoded secrets (moves to env vars)--all → also fixes: TLS bypass (rejectUnauthorized: false), Docker :latest tags, debug mode enabled, dangerouslySetInnerHTML without sanitization, shell: true in exec/spawnShow the user what will be changed:
.env.example, .env)Ask the user if they want to proceed. If yes:
npx ship-safe@latest remediate . --all --yes 2>&1
If the user only wants to fix secrets (not agent findings):
npx ship-safe@latest remediate . --yes 2>&1
After applying fixes:
Run a quick scan to verify secrets were removed:
npx ship-safe@latest scan . --json 2>/dev/null
Report the results — how many issues were fixed vs. remaining
For remaining issues that couldn't be auto-fixed, offer to fix them manually by reading the code and applying targeted changes
Suggest:
.env.example — make sure variable names make sense.env to .gitignore if not already therenpx ship-safe rotate . for step-by-step guides/ship-safe-baseline . to update after fixes--all flag is important for fixing agent-level findings beyond just secretsshell: false in exec), warn the user to testdangerouslySetInnerHTML fixes, note that DOMPurify needs to be installed: npm install dompurify