Paste your repo or live URL. Get a plain-English report of the security holes and bugs AI tools tend to leave behind, plus copy-paste fix prompts you can drop straight into Lovable, Cursor or Bolt.
Secret database key is visible in your website's code
Anyone can open your site, find this key and read or delete every user's data.
Users can read each other's data
Row Level Security is off on the projects table.
Illustrative example, not a real customer report
Our agents do the digging. You get a short, ranked list of what to fix and exactly what to tell your AI tool.
Drop in a public GitHub repo or your live URL, plus the email where we should send the report.
Automated checks look for leaked keys, open databases, unprotected pages and risky settings, the usual gaps AI tools leave behind.
Get a plain-English report ranked by risk, with a ready-made prompt for each issue to paste into your AI coding tool.
The issues that rarely show up in a demo but matter once you have real users, real data and real payments.
Secret keys for Supabase, Stripe, OpenAI and others left in front-end code or Git history.
Tables with Row Level Security off or overly permissive policies that let users see each other's data.
Pages and API endpoints that work without logging in or for the wrong user.
Wide-open cross-origin rules that let any website call your API.
Stack traces, source maps and verbose errors exposed in production.
Login and AI endpoints open to brute force or bots running up your API bill.
Stripe webhooks that aren't verified, so anyone could fake a "paid" event.
Forms that trust whatever users send, opening the door to injected scripts.
Missing environment separation, security headers and basic logging.
See what we found before you pay anything.
Everything you need to fix it yourself.
No. Reports are written for people who build with AI tools. Each issue comes with a prompt you can paste into your AI tool to fix it.
The teaser scan is free and shows how many issues we found by severity, plus your top issue explained. The full report is a one-off £29 including VAT and includes every finding ranked by risk, copy-paste fix prompts and a free re-scan after you fix things.
We only read what you share: a public GitHub repo or a live URL. We use it only to produce your report and never share it. Cloned code is deleted as soon as the scan finishes, and reports are deleted after 30 days. Never send us secret keys; if we find any in your code, rotate them. See our privacy policy for full details.
No. ShipMender is an automated scan for common issues in AI-built apps. It can miss things and isn't a substitute for a full professional security audit or penetration test. If you handle sensitive data or payments at scale, get a professional audit as well.
Apps built with Lovable, Cursor, Bolt, v0 and Replit, especially React or Next.js front ends with a Supabase backend. Other stacks get the general checks.
Not yet. For now, use a public repo or your live URL. Private repo support is planned.
No. Only scan sites and repos you own or are authorised to test. You confirm this before every scan.
Plain-English security guides for apps built with AI tools. No jargon, just what to check and what to tell your AI.
Twelve checks you can run before real users arrive, written for Lovable, Bolt and Cursor builders.
The Row Level Security gaps AI tools commonly leave, and the prompts to fix them.
How secret keys end up in front-end code and Git history, and what to do if yours has.
A launch-day list covering auth, payments, rate limits, headers and backups.
A free weekly email for builders and vibe coders.
Unsubscribe anytime. PLACEHOLDER: digest signup not connected yet
Thanks! Signups open soon.