# ShipWatch

> ShipWatch is a hosted, passive, read-only security scanner for live web apps built with AI tools such as Lovable, Bolt, v0, Replit and Cursor, including apps that use Supabase. You paste a public URL and get a plain-English report of common, visible mistakes (leaked secret keys, a public .env file or .git folder, missing security headers, missing HTTPS redirect), with a copy-paste fix prompt for each issue. The free scan needs no signup: https://shipwatchhq.com/#scan

ShipWatch is for founders, indie hackers and small teams who built and shipped an app by prompting an AI tool and want to know whether it is leaking anything a stranger could see. It needs no code, repository access or login; it looks at the live app from the outside. Owner: William T. Stephens. Contact: support@williamtstephens.com.

What the free scan checks, on the URL you submit:

- Leaked secret keys in the page HTML and in up to 25 JavaScript files the page links to (script src and modulepreload): Stripe live secret and restricted keys (sk_live_, rk_live_), OpenAI API keys, Anthropic API keys, AWS access key IDs (AKIA/ASIA), Google API keys (AIza), Supabase service_role keys (detected by decoding the JWT's role), and Supabase secret keys (sb_secret_). Leaked values are shown masked (first and last 4 characters).
- Supabase detection: if a Supabase anon/publishable key or project URL is found, the report notes it as informational (that key is public by design) and gives a prompt to audit Row Level Security. ShipWatch does not test your database or RLS policies.
- Exposed files: whether /.env at the site root returns KEY=value lines, and whether /.git/HEAD returns a git ref.
- Security headers on the page response: Content-Security-Policy, Strict-Transport-Security (HSTS, on HTTPS sites), X-Frame-Options or CSP frame-ancestors, and X-Content-Type-Options.
- HTTPS: whether the site is served over HTTPS, and whether http:// redirects to https://.
- Each finding has a severity (critical, high, medium, low, info), a plain-English explanation and a fix prompt to paste into Cursor, Lovable or a similar tool. The report includes a score out of 100.
- The free result shows the score, a severity summary, the title of every issue found, and the full explanation and fix prompt for the most serious issue.

What ShipWatch does not do:

- It is passive and read-only. It makes ordinary GET requests like a browser (plus /.env and /.git/HEAD). It does not log in, submit forms, guess passwords, run exploits or load-test anything.
- It is not a penetration test or a professional security audit.
- It does not query databases and does not test Supabase Row Level Security, authentication logic or server-side code.
- It does not crawl other pages of the site, scan JavaScript that the page doesn't link to directly, check .env variants such as .env.local, or read repository history.
- It refuses private and internal addresses (localhost, private IP ranges, .local hosts).
- A clean report is not a guarantee that an app is secure.
- Only scan apps you own or are authorized to test. Free scans are rate-limited per IP address (5 scans per 10 minutes) and free scan results are not stored.

Pricing:

- Free scan: $0, one-off check, no signup.
- Solo: $19/month or $190/year, weekly monitoring for 1 app.
- Pro: $49/month or $490/year, weekly monitoring for up to 5 apps.
- Paid plans unlock every finding's full detail and fix prompt, rescan each app weekly, compare each scan with the previous one and flag anything that got worse, with reports on a private dashboard. Weekly monitoring only runs on apps whose owner has verified ownership with a DNS TXT record or a meta tag. Payments are handled by Stripe; plans can be cancelled from the dashboard.

## Main pages

- [ShipWatch home](https://shipwatchhq.com/): What ShipWatch checks, how it works, pricing and FAQ
- [Free security scan](https://shipwatchhq.com/#scan): Paste a live URL to run the free, read-only scan; no signup
- [About ShipWatch (plain text)](https://shipwatchhq.com/about.txt): What ShipWatch is, who it's for, and what it does and doesn't check

## Guides

- [Lovable app security check](https://shipwatchhq.com/lovable-app-security-check): How to check a Lovable app yourself: Supabase RLS, leaked keys in the JavaScript bundle, exposed files and headers, with fix prompts
- [Supabase RLS checker](https://shipwatchhq.com/supabase-rls-checker): How to test Supabase Row Level Security on your own project and fix loose policies
- [Supabase service_role key exposed](https://shipwatchhq.com/supabase-service-role-key-exposed): How to tell the public anon key from the service_role key, check whether it leaked, and rotate it
- [API key exposed in frontend](https://shipwatchhq.com/api-key-exposed-in-frontend): Why keys in Vite, React or Next.js frontends are public, which ones are dangerous, and how to move them server-side
- [Vibe coding security checklist](https://shipwatchhq.com/vibe-coding-security-checklist): A 12-item pre-launch checklist for AI-built apps covering secrets, database rules, exposed files, headers, HTTPS and server-side checks
- [Bolt, v0 & Replit app security](https://shipwatchhq.com/bolt-v0-replit-app-security): Where secrets tend to leak in Bolt, v0 and Replit apps, how to check a live app, and fix prompts for each
- [Is your .env file exposed?](https://shipwatchhq.com/env-file-exposed-check): How to check whether /.env or /.git is publicly downloadable, why it happens, how to block it, and why every key in the file must be rotated

## Policies

- [Privacy Policy](https://shipwatchhq.com/privacy): What ShipWatch collects, why, who processes it (Stripe, Cloudflare), retention and deletion
- [Terms of Service](https://shipwatchhq.com/terms): What the service does, authorized use only, no guarantee, plans and billing, cancellation