ABOUT SHIPWATCH
https://shipwatchhq.com

WHAT SHIPWATCH IS

ShipWatch is a hosted security scanner for live web apps, especially apps
built with AI tools such as Lovable, Bolt, v0, Replit and Cursor, and apps
that use Supabase.

You paste the public URL of your app. ShipWatch looks at it from the outside,
the way a stranger's browser would, and returns a plain-English report of
common, visible security mistakes. Every issue comes with a fix prompt you can
paste back into your AI coding tool.

The free scan needs no signup: https://shipwatchhq.com/#scan

WHO IT'S FOR

Founders, indie hackers and small teams who built and shipped an app by
prompting an AI tool and want to know whether it is exposing anything it
shouldn't. You don't need security experience, and you don't need to connect
your code, repository or accounts.

WHAT THE FREE SCAN CHECKS

1. Leaked secret keys. ShipWatch reads your page's HTML and up to 25
   JavaScript files the page links to, and looks for:
   - Stripe live secret and restricted keys (sk_live_, rk_live_)
   - OpenAI API keys
   - Anthropic API keys
   - AWS access key IDs (AKIA / ASIA)
   - Google API keys (AIza)
   - Supabase service_role keys (found by decoding the key's role)
   - Supabase secret keys (sb_secret_)
   Any key found is shown masked (first and last 4 characters only), so the
   report doesn't leak it again.

2. Supabase heads-up. If your app uses Supabase, the report says so. The
   Supabase anon / publishable key is public by design; your data is only as
   safe as your Row Level Security policies. ShipWatch gives you a prompt to
   audit them but does not test your database.

3. Exposed files. Whether https://yourapp.com/.env returns KEY=value lines,
   and whether https://yourapp.com/.git/HEAD is downloadable.

4. Security headers. Content-Security-Policy, Strict-Transport-Security
   (HSTS), X-Frame-Options (or CSP frame-ancestors) and
   X-Content-Type-Options.

5. HTTPS. Whether the site is served over HTTPS and whether http:// redirects
   to https://.

Each finding has a severity (critical, high, medium, low or info), a short
explanation and a fix prompt. The report also gives a score out of 100.

The free result shows your score, a severity summary, the title of every
issue found, and the full explanation and fix prompt for the most serious
issue.

WHAT SHIPWATCH DOES NOT DO

- It is passive and read-only. It makes ordinary requests like a browser
  (plus /.env and /.git/HEAD). It never logs in, submits forms, guesses
  passwords, runs exploits or load-tests anything.
- It is not a penetration test or a professional security audit.
- It does not query your database, and it does not test Supabase Row Level
  Security, your authentication logic or your server-side code.
- It does not crawl every page of your site, read your repository or its
  history, or check .env variants such as .env.local.
- A clean report is not a guarantee that your app is secure.

Only scan apps you own or are authorized to test.

PRICING

- Free scan: $0. One-off check, no signup.
- Solo: $19/month or $190/year. Weekly monitoring for 1 app.
- Pro: $49/month or $490/year. Weekly monitoring for up to 5 apps.

Paid plans show every finding's full detail and fix prompt, rescan each app
every week, compare each scan with the last one and flag anything that got
worse, with reports on a private dashboard. Monitoring only runs on apps you
prove you own with a DNS TXT record or a meta tag. Payments are handled by
Stripe, and you can cancel from your dashboard.

PRIVACY IN SHORT

Free scan results are not stored. Your IP address is used only for rate
limiting. Full details: https://shipwatchhq.com/privacy

WHO RUNS IT

ShipWatch is owned and operated by William T. Stephens.
Contact: support@williamtstephens.com

LINKS

Home:            https://shipwatchhq.com/
Free scan:       https://shipwatchhq.com/#scan
Guides:
  https://shipwatchhq.com/lovable-app-security-check
  https://shipwatchhq.com/supabase-rls-checker
  https://shipwatchhq.com/supabase-service-role-key-exposed
  https://shipwatchhq.com/api-key-exposed-in-frontend
  https://shipwatchhq.com/vibe-coding-security-checklist
  https://shipwatchhq.com/bolt-v0-replit-app-security
  https://shipwatchhq.com/env-file-exposed-check
For AI tools:    https://shipwatchhq.com/llms.txt
Privacy Policy:  https://shipwatchhq.com/privacy
Terms:           https://shipwatchhq.com/terms