About ShipWatch

ShipWatch looks at your live app from the outside, the way a stranger's browser would, and tells you in plain English what it's exposing, with a fix prompt for each issue.

What ShipWatch is

ShipWatch is a hosted security scanner for live web apps, especially apps built with AI tools such as Lovable, Bolt, v0, Replit and Cursor, and apps that use Supabase. You paste a public URL; ShipWatch returns a report of common, visible security mistakes, each with a prompt you can paste back into your AI coding tool. The free scan needs no signup.

Who it's for

Founders, indie hackers and small teams who built and shipped an app by prompting an AI tool and want to know whether it's exposing anything it shouldn't. You don't need security experience, and you don't connect your code, repository or accounts.

What the free scan checks

• Leaked secret keys in your page's HTML and up to 25 JavaScript files it links to: Stripe live secret and restricted keys (sk_live_, rk_live_), OpenAI and Anthropic API keys, AWS access key IDs, Google API keys, Supabase service_role keys and Supabase secret keys (sb_secret_). Keys are shown masked.
• Supabase heads-up: if your app uses Supabase, the report says so and gives you a prompt to audit Row Level Security. It does not test your database.
• Exposed files: whether /.env returns KEY=value lines and whether /.git/HEAD is downloadable.
• Security headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or CSP frame-ancestors) and X-Content-Type-Options.
• HTTPS: whether the site uses HTTPS and whether http:// redirects to https://.

Each finding has a severity, a short explanation and a fix prompt, and the report includes a score out of 100. The free result shows your score, a severity summary, the title of every issue, and the full explanation and fix prompt for the most serious one.

What it doesn't do

• It's passive and read-only: it never logs in, submits forms, guesses passwords, runs exploits or load-tests anything.
• It's not a penetration test or a professional security audit.
• It doesn't query your database or test Row Level Security, your auth logic or your server code.
• It doesn't crawl every page, read your repository or its history, or check .env variants like .env.local.
• A clean report is not a guarantee that your app is secure.

Only scan apps you own or are authorized to test.

Pricing

• Free scan: $0, one-off check, no signup.
• Solo: $19/month or $190/year, weekly monitoring for 1 app.
• Pro: $49/month or $490/year, weekly monitoring for up to 5 apps.

Paid plans show every finding's full detail and fix prompt, rescan weekly, and flag anything that got worse since the last scan on a private dashboard. Monitoring only runs on apps you've verified you own with a DNS TXT record or a meta tag.

Who runs it

ShipWatch is owned and operated by William T. Stephens. Contact: support@williamtstephens.com. See the Privacy Policy and Terms.