Ship Check · Coming soon
You shipped it in a weekend. Is it safe?
AI tools make it easy to build an app and easy to leak a secret key with it. Ship Check finds what your app exposes and gives you a fix you can paste straight back into Lovable, Bolt, Cursor, Replit, or v0.
What we check
The mistakes AI-built apps make most.
Not a wall of scary jargon. The handful of issues that actually get apps breached, explained like a teammate would.
Leaked secrets in your bundle
OpenAI, Stripe secret, and Supabase service-role keys shipped to every visitor's browser.
Open databases
Supabase tables without row-level security and Firebase rules that let anyone read or write.
Exposed files
.env files, .git folders, and source maps that hand out your code and credentials.
Headers & TLS
Missing security headers, weak TLS, permissive CORS, and insecure cookies.
Forgotten subdomains
Old preview deployments and dangling DNS records someone else could take over.
Debug & admin panels
Dev servers, debug modes, and admin dashboards reachable from the open internet.
Fixes, not fear
Every finding comes with a prompt your AI can act on.
You don't need to learn security to fix your app. Copy the prompt, paste it into your coding tool, and redeploy.
Supabase admin key is public
Anyone who opens your site can read, change, or delete every row in your database.
Fix prompt
My app exposes a Supabase service_role key in the client-side JavaScript bundle (found in /assets/index-8f2a.js). This key bypasses row-level security. 1. Remove every use of the service_role key from client code; the browser should only ever use the anon key. 2. Move any operation that needs elevated access into a server-side function (e.g. a Supabase Edge Function). 3. Make sure row-level security is enabled on every table, with policies for the anon role. 4. Tell me to rotate the service_role key in the Supabase dashboard, since it has already been exposed.
How it works
From one-off check to always watched.
- 01
Paste your URL
No sign-up. We look at your app the way any visitor's browser would.
- 02
Copy the fix prompt
Every finding comes in plain English with a prompt you paste into your AI coding tool.
- 03
Verify your domain
Add one DNS record to prove it's yours and unlock deeper checks.
- 04
Get watched for free
We keep checking your app and email you the moment something new is exposed.
Unverified checks only look at what's already public to any visitor. Deeper testing only ever runs against domains you've proven you own.
FAQ
Questions builders ask us.
Is my Lovable, Bolt, or v0 app secure?
AI coding tools generate working apps quickly, but they often ship secret API keys in the browser bundle, leave Supabase row-level security off, or expose .env files. Ship Check looks for exactly these mistakes and tells you in plain English what to fix.
Is my Supabase anon key safe to have in my frontend?
Yes. The anon key is designed to be public, as long as row-level security is enabled on your tables. The service_role key is different: it bypasses row-level security and must never appear in client code. Ship Check flags a service_role key in your bundle as critical and leaves the anon key alone.
Do I need to sign up to use Ship Check?
No. The instant check needs only your app's URL. Signing up and verifying your domain unlocks deeper checks and free continuous monitoring.
Will Ship Check attack or slow down my app?
No. Without verification, Ship Check only fetches what any visitor's browser would: your page and the files it loads. Deeper testing runs only against domains you have proven you own, using a DNS record.
How do I fix what Ship Check finds?
Every finding comes with a fix prompt. Paste it into Lovable, Bolt, Cursor, Replit, v0, or Claude Code and your AI tool makes the change. Steps it can't do for you, like rotating a leaked key, are spelled out at the end.
Is Ship Check free?
Yes. The instant check and continuous monitoring for one app are free. Ship Check is in development now; join the waitlist and we'll check your app as soon as it's ready.
Be first to check your app.
Ship Check is in development. Join the waitlist and we'll run your app through it as soon as it's ready, for free.