# ShipGuard

> ShipGuard is a passive pre-launch security scanner for apps built with AI tools (Lovable, Bolt.new, Cursor, v0, Replit) and Supabase. It checks a deployed URL for secrets in client JavaScript, Supabase schema/storage enumeration via the public anon key, publicly served .env/.git/source-map files, and missing security headers. Findings are labelled heuristic or confirmed, and come with stack-specific fix prompts.

Key facts:
- Passive and read-only: GET requests only, 8s per-request timeout, ~25s total budget, private/internal addresses refused.
- Detected secrets are redacted to their first 6 characters before storage.
- Pricing: free scan (grade + 1 full finding); Launch Pass — $29 One-Time; Continuous Vibe-Guard $99/year with a Verified Production-Safe badge; Verified Remediation Partner $499/month (3 slots).
- A good grade is not a guarantee of security; the scanner cannot see server code or database policies.

## Product
- [Home / scanner](https://getshipguard.com/)
- [Pricing](https://getshipguard.com/pricing)
- [About & scanning ethics](https://getshipguard.com/about)
- [Supabase RLS SQL generator](https://getshipguard.com/tools/rls-generator)
- [Blast-radius calculator](https://getshipguard.com/calculator): illustrative estimates only

## Guides
- [Lovable + Supabase RLS Checklist Before You Launch](https://getshipguard.com/guides/lovable-supabase-rls-checklist): A practical Row Level Security checklist for Lovable apps backed by Supabase: enable RLS, write owner policies, lock down storage and test with the anon key.
- [Bolt.new: How to Fix Exposed API Keys in Your Frontend](https://getshipguard.com/guides/bolt-new-exposed-api-keys-fix): Why API keys end up in Bolt.new client bundles, how to find them, and the server-side proxy pattern that fixes it.
- [Cursor + Next.js: Environment Variable Security](https://getshipguard.com/guides/cursor-nextjs-env-security): How NEXT_PUBLIC_ works, why AI-generated Next.js code leaks server config, and how to enforce the server/client boundary with server-only.
- [Supabase service_role Key Leaked? Fix It in This Order](https://getshipguard.com/guides/supabase-service-role-key-leaked-fix): Step-by-step incident response for a leaked Supabase service_role or sb_secret_ key: rotate, remove from client, review access, and prevent recurrence.
- [v0 + Vercel: Production Security Headers](https://getshipguard.com/guides/v0-vercel-production-headers): Add HSTS, CSP, X-Frame-Options and nosniff to a v0-generated Next.js app on Vercel using next.config headers or vercel.json.
- [Replit Secrets & Deployment Security Checklist](https://getshipguard.com/guides/replit-secrets-deployment-checklist): Keep API keys in Replit Secrets, out of client code and out of public Repls, and harden a Replit deployment before launch.
- [Supabase Storage Bucket Policies for Vibe-Coded Apps](https://getshipguard.com/guides/supabase-storage-bucket-policies): Public vs private buckets, owner-scoped storage.objects policies and signed URLs — the storage settings to check before launch.
- [Stripe Secret Key in Your Frontend: How to Fix It](https://getshipguard.com/guides/stripe-secret-key-in-frontend-fix): If sk_live_ is in your JavaScript bundle, here is how to roll it, move payments server-side with Checkout, and verify webhooks.
- [OpenAI API Key Exposed in the Browser: Fix and Prevent](https://getshipguard.com/guides/openai-api-key-exposed-in-browser): Why sk-proj- keys in client code get abused, how to proxy OpenAI calls safely, and the limits to set at the provider.
- [Anthropic API Key in Client-Side Code: What to Do](https://getshipguard.com/guides/anthropic-api-key-client-side-leak): Detect sk-ant- keys or ANTHROPIC_API_KEY values in your bundle, rotate them, and move Claude calls behind a server route.
- [Vite Environment Variables: What Is Actually Public](https://getshipguard.com/guides/vite-env-variables-security): How Vite's VITE_ prefix and import.meta.env work, which values end up in your bundle, and how to keep secrets server-side.
- [NEXT_PUBLIC_ Pitfalls in AI-Generated Next.js Apps](https://getshipguard.com/guides/nextjs-public-env-prefix-pitfalls): Common ways NEXT_PUBLIC_ variables leak secrets in Next.js projects built with AI tools, and safe alternatives.
- [Publicly Exposed .env File: Detection and Fix](https://getshipguard.com/guides/exposed-dotenv-file-fix): How .env files end up downloadable on production sites, how to test for it without false positives, and how to fix and rotate.
- [Exposed .git Directory on Production: Fix Guide](https://getshipguard.com/guides/exposed-git-directory-fix): Why a reachable /.git/config lets attackers rebuild your source code and history, and how to stop serving it.
- [Production Source Maps: Risk and How to Disable Them](https://getshipguard.com/guides/production-source-maps-risk): What public .js.map files reveal, when they matter, and how to disable or privately upload them in Next.js and Vite.
- [Content-Security-Policy for Vibe-Coded Apps](https://getshipguard.com/guides/content-security-policy-for-vibe-coded-apps): A starter CSP for React/Next.js/Vite apps built with AI tools, how to roll it out in report-only mode, and how to handle inline scripts.
- [HSTS Setup on Vercel and Netlify](https://getshipguard.com/guides/hsts-setup-vercel-netlify): Add Strict-Transport-Security on Vercel (vercel.json / next.config) and Netlify (_headers), choose a max-age and decide on preload.
- [CORS Wildcards and Origin Reflection: Fix Guide](https://getshipguard.com/guides/cors-wildcard-api-fix): When Access-Control-Allow-Origin: * is fine, when origin reflection with credentials is dangerous, and how to write an allowlist.
- [Is the Supabase Anon Key Safe to Expose?](https://getshipguard.com/guides/supabase-anon-key-is-it-safe): What the anon/publishable key can and cannot do, how it differs from service_role and sb_secret_ keys, and what actually protects your data.
- [Lovable Pre-Launch Security Checklist](https://getshipguard.com/guides/lovable-pre-launch-security-checklist): Ten checks to run on a Lovable app before you share it: keys, Supabase RLS, storage, edge functions, headers and auth settings.
- [Bolt.new + Supabase Auth Hardening](https://getshipguard.com/guides/bolt-new-supabase-auth-hardening): Lock down sign-up, redirect URLs, session handling and per-user data access in a Bolt.new app using Supabase Auth.
- [Security Review Checklist for Cursor-Generated Code](https://getshipguard.com/guides/cursor-ai-generated-code-security-review): A focused review checklist for code written with Cursor: secrets, authz on every route, input validation, dependency hygiene.
- [Hardening an App Built with Replit Agent](https://getshipguard.com/guides/replit-agent-app-hardening): Post-generation hardening steps for Replit Agent apps: secrets, database access, auth checks, static serving and headers.
- [Resend API Key Leaked: Rotation and Damage Control](https://getshipguard.com/guides/resend-api-key-leak-rotation): What an exposed re_ key allows, how to revoke it, and how to move email sending to a server route with domain restrictions.
- [Supabase PostgREST Schema Exposure: What It Means](https://getshipguard.com/guides/supabase-postgrest-openapi-schema-exposure): Why your table list is visible via /rest/v1/ with the anon key, what attackers learn from it, and how to reduce exposure.
- [Rate Limiting AI Endpoints in Vibe-Coded Apps](https://getshipguard.com/guides/rate-limiting-ai-endpoints): Protect LLM-backed routes from abuse with per-user limits, input caps and spend alerts, using Upstash Redis or your database.

## Comparisons
- [Lovable vs Bolt.new: Security Considerations](https://getshipguard.com/compare/lovable-vs-bolt-security): How typical Lovable and Bolt.new projects differ in where secrets live, how data is protected, and what to check before launch.
- [Supabase RLS vs Firebase Security Rules](https://getshipguard.com/compare/supabase-rls-vs-firebase-rules): Postgres Row Level Security compared with Firebase/Firestore Security Rules: model, defaults, testing and common mistakes.
- [v0 vs Lovable: Security Responsibilities](https://getshipguard.com/compare/v0-vs-lovable-security): v0 focuses on UI and Next.js code you deploy yourself; Lovable ships hosted full-stack apps on Supabase. What that means for security.
- [Cursor vs Replit Agent: Security Workflow](https://getshipguard.com/compare/cursor-vs-replit-agent-security): Securing code from an AI editor (Cursor) versus an AI agent with hosting (Replit Agent): rules, secrets, review and deploy.
- [Vercel vs Netlify: Configuring Security Headers](https://getshipguard.com/compare/vercel-vs-netlify-security-headers): Where to set HSTS, CSP and friends on Vercel (next.config / vercel.json) versus Netlify (_headers / netlify.toml).
- [Supabase vs Firebase: Which Keys Are Public?](https://getshipguard.com/compare/supabase-vs-firebase-api-keys): A side-by-side list of public versus secret credentials in Supabase and Firebase projects.
- [Next.js vs Vite: Environment Variables and Secrets](https://getshipguard.com/compare/nextjs-vs-vite-env-variables): NEXT_PUBLIC_ versus VITE_: how each framework decides what reaches the browser, and where secrets belong.
- [Passive Security Scan vs Penetration Test](https://getshipguard.com/compare/passive-scan-vs-penetration-test): What a passive pre-launch scanner can and cannot tell you compared with an authenticated penetration test.
- [VibeShield Alternative: How ShipGuard Approaches Pre-Launch Scanning](https://getshipguard.com/compare/vibeshield-alternative): Evaluating a VibeShield alternative? Objective criteria for vibe-coded app scanners and what ShipGuard specifically offers.
- [VibeAppScanner Alternative: Criteria for Choosing a Vibe-Coded App Scanner](https://getshipguard.com/compare/vibeappscanner-alternative): Looking for a VibeAppScanner alternative? A neutral checklist for evaluating scanners, plus what ShipGuard specifically provides.
- [Snyk for Lovable Builders? Where a Passive Production Scan Fits](https://getshipguard.com/compare/snyk-for-lovable-builders): Snyk focuses on code, dependencies and cloud configuration; ShipGuard scans the deployed app. How Lovable builders can think about using each.

## Optional
- [Full text for LLMs](https://getshipguard.com/llms-full.txt)