Shipmark / Free tools

Free tools

Free, no sign-up, and nothing you enter is stored.

Tool

SBOM and vulnerability scanner

Drop a lockfile from a Flutter, React Native, iOS or Android project and get a CycloneDX SBOM and the known vulnerabilities in seconds. The file stays in your browser.

Open the scanner → Check

Does the CRA apply to my app?

Six questions about how your app is used, sold and built, and a clear answer with the reasons and dates.

Start the check → Calculator

Reporting deadline calculator

Enter when you became aware of an exploited vulnerability or incident and get the 24-hour, 72-hour and final report deadlines, plus a calendar file.

Calculate deadlines → GitHub Action

SBOM on every build

Two lines in your workflow: a CycloneDX SBOM for the whole app and an OSV check on every build or release. Free and open source.

View on GitHub Marketplace →

Maintaining apps for clients? Founding agencies use Shipmark free until 1 April 2027, including a CRA check for one of their apps.

Join the free beta