Your AI changed your app 40 times this week. Did it leak a key or open your database?
ShipCheck scans your live app for leaked API keys, open Supabase tables, exposed files, missing security headers and SEO blind spots, then emails you a weekly report of what's new, what's fixed and what's still open, with copy-paste fix prompts.
Free, no sign-up needed for the summary. Takes about 20 seconds.
- FAILNEWStripe secret key in JS bundlecritical · /assets/index-4f2a.js
- FAILNEW/.env is publicly readablehigh · exposed files
- WARNSTILL OPENNo Content-Security-Policymedium · headers
- WARNSTILL OPENBlank page without JavaScriptlow · findability
- PASSSSL certificate valid, 71 days lefttls
Example data for illustration. Not a real site.
Move the Stripe secret key out of the frontend into a Supabase Edge Function secret, then rotate it in the Stripe dashboard.
of Supabase-backed vibe-coded apps in one public scan of 3,680 apps served table rows to anonymous requests.
is all it takes for an AI builder to move a secret key into frontend code or switch off server rendering.
re-scans and a diff mean you hear about it from ShipCheck, not from your users.
Stat source: community scan write-up on r/vibecoding (2026). Your results will vary.
What we check
What ShipCheck checks
Passive checks run on every scan, from the outside, the way an attacker or a search engine sees your app. The active Supabase check runs only for verified owners.
Leaked API keys
We read your HTML and JavaScript bundles the way an attacker would, looking for Stripe secret keys, OpenAI/Anthropic keys, AWS keys, Supabase service_role keys and more.
Open Supabase tables
We detect your Supabase project and public key. Verify you own the site and we'll test, read-only, which tables answer anonymous reads, counting rows without ever reading them.
Exposed files
Public /.env files, /.git folders and source maps that hand out your secrets and source code.
Security headers
Content-Security-Policy, HSTS, clickjacking protection, nosniff, Referrer-Policy and HTTPS redirects.
Findability
What Google and AI crawlers see without JavaScript: title, description, real content, robots.txt, sitemap, noindex and canonical tags.
Uptime, SSL and domain expiry
Hourly uptime pings with alerts, and early warnings before your SSL certificate or domain registration expires.
How it works
From URL to weekly report
- 01
Paste your URL.
Get a free instant scan with a health score and a summary of issues.
- 02
Get the full report.
Enter your email to unlock plain-English explanations and copy-paste fix prompts for Lovable, Cursor and Claude.
- 03
Stay covered.
Subscribe for weekly (or daily) re-scans, NEW/FIXED diffs, uptime alerts and expiry warnings.
The weekly diff
Know what changed, not just what's wrong.
Every scan is compared with the last one. A finding only counts as fixed if its check actually ran again, so a flaky fetch never hides a leak.
- NEW OpenAI key in /assets/chat-91c.js
- FIXED Missing HSTS header
- STILL OPEN Page has noindex
- // example data, not a real scan
Pricing
Simple pricing
Prices in USD. Cancel anytime.
Solo
For your one app
- 1 app
- Weekly automatic scan + diff email
- Hourly uptime checks with alerts
- Supabase table-exposure probe (verified owners)
- SSL & domain expiry warnings
- Copy-paste fix prompts
Builder
For serial shippers
- 5 apps
- Daily automatic scans
- Weekly report + instant email on new issues
- Hourly uptime checks with alerts
- Everything in Solo
Agency
For client work
- 25 client apps
- White-label PDF reports
- Daily scans
- Contact us for early access
Free $0
- Instant passive scan
- Full report by email
- 1 app in dashboard (manual scans)
FAQ
Questions, answered
Is the free scan safe to run on my site?
Yes. Free scans are passive: we request your public pages, JavaScript files and a handful of well-known paths (like /robots.txt and /.env), the same way any browser or search engine could. We don't log in, submit forms, or touch your database.
Do you store my secrets if you find them?
No. We only keep a redacted preview (the first 6 characters) and a one-way fingerprint so we can tell whether the same key is still there next week.
How is this different from Lovable's built-in security scan or Supabase's Security Advisor?
Use those too! They look at your project from the inside. ShipCheck looks at your live site from the outside, the way an attacker or Google sees it, and it keeps doing that every week. Every new prompt or redeploy can bring back a leaked key or a noindex tag, and our weekly diff shows exactly what changed.
What's the Supabase table check?
Your Supabase anon key is public by design; Row Level Security is what protects your data. After you verify you own the site, we use your own public key to ask each exposed table for a row count (an HTTP HEAD request). If a table answers with rows, anyone on the internet can read it. We never download or store row data.
Which builders does it work with?
Any public website: Lovable, Bolt, Cursor, Replit, v0, Base44, Windsurf, hand-written code. Many checks are tuned for the Supabase and Vite/React stacks these tools generate.
What do I get with the fix prompts?
For each issue we give a plain-English explanation and a copy-paste prompt tailored for Lovable, Cursor and Claude, so you can paste it straight into your AI builder.
Can I cancel any time?
Yes. Manage or cancel your subscription from the billing portal in your dashboard. You keep access until the end of the period you've paid for.
More: Is the Supabase anon key safe? · Supabase RLS checker · Lovable security scan
Find out what your live app is leaking.
Free passive scan, about 20 seconds, no sign-up for the summary.
Run a free scan