Launched this week
ShipWatch
Your AI built it. Did it leak? Free live-app security scan
2 followers
Your AI built it. Did it leak? Free live-app security scan
2 followers
ShipWatch scans your live app the way a stranger would — finding leaked API keys, exposedenv andgit files, and missing security headers. Every issue comes with a fix prompt you paste back into Lovable, Cursor or Bolt. Free scan: score + severity summary, no sign-up, under 30 seconds. Solo $19/mo · Pro $49/mo · annual = 2 months free. Paid plans add every fix prompt + weekly rescans on your dashboard. Honest limit: ShipWatch does NOT check database grants or RLS policies.
Free Options
Launch Team
TK by MediumAn agentic notebook to build your best thinking
Promoted
Hi PH, I'm William and I built ShipWatch.
AI builders ship fast, and sometimes they ship a secret key in the JavaScript every visitor downloads, or a site that serves /.env. ShipWatch checks your live URL from outside:
- Secret keys in your HTML and up to 25 scripts: Stripe, OpenAI, Anthropic, AWS, Google, and Supabase service_role / sb_secret_
- Whether /.env or /.git/HEAD is downloadable
- HTTPS + redirect, plus CSP, HSTS, frame protection and nosniff
- A plain-English fix prompt for each issue
A timely one if you're on Supabase: since Oct 30, new tables need explicit GRANTs, and the first sign is error 42501. The risky fix is disabling RLS. I wrote up the safe fix: https://shipwatchhq.com/guides/s.... To be clear, ShipWatch doesn't check grants or RLS (they aren't visible from outside). What it catches is a leaked service_role key, which bypasses all of them.
It never logs in, submits forms or tries exploits, and a clean report doesn't mean an app can't be hacked. Free scan: score, every issue, full fix for the top one. Solo ($19/mo or $190/yr) and Pro ($49/mo or $490/yr) add every fix and weekly rescans compared on your dashboard, for apps you've verified you own. Only scan apps you own. What check should I add next?