Loading…
For founders shipping with Lovable, Bolt, Cursor, and Replit
ShipWatch checks the money path on the app you built with an AI tool. It signs up, logs in, pays in Stripe test mode, and confirms the account was actually upgraded. If another user can see that data, you hear about that too.
$19 a month for one app. $49 for five. No engineer required.
Vibe-coded apps often show a success page the moment Stripe redirects back. The webhook that should flip the user to paid never runs, or it returns 200 and updates nobody. The founder finds out from a customer, not from a test.
A second bug sits next to it: a project URL with no ownership check, or a Supabase table the anon key can read. ShipWatch looks for both, on a schedule, with accounts you control.
Add the URL and two test accounts
One account pays. The other is only there to catch a page that should have stayed private.
A browser walks the money path
Every day ShipWatch signs up, logs in, opens the paywall, and pays with Stripe test card 4242.
Paid access has to actually unlock
A thank-you page is not enough. The members area still has to show the paid state after the webhook runs.
You get a prompt, not a stack trace
Failures arrive by email, with a short explanation and text you can paste into Cursor or Lovable.
Signup and login
The test account can create a session.
Paywall
A locked plan is visible before payment.
Stripe test checkout
The card form accepts 4242 and reaches success.
Paid access
The account is upgraded after checkout.session.completed.
Cross-user leak
User B cannot open user A's private pages.
Secret scan
Live Stripe, OpenAI, and service-role keys are not in public JavaScript.
Supabase anon read
The anon key does not list other people's rows.
Daily runs, failure email, optional Slack, and a weekly note when the money path is still healthy. The public scan stays free.