Loading…
Answers about the checks ShipWatch actually runs.
ShipWatch runs a daily browser check on an app you own. It signs up, logs in, opens the paywall, pays with a Stripe test card, and checks that paid access was actually granted. It then logs in as a second test user and tries to open the first user's private pages. It also reads the public page and same-origin scripts for live secret keys, and, when it finds a Supabase URL plus an anon key, it checks whether that key can read rows.
It is for people shipping an app with Lovable, Bolt, Cursor, or Replit who want a daily check that the money path still works. You add the app URL and two test accounts that you control.
The daily check drives the app in a browser, so it is not tied to one framework. If signup, login, checkout, or the paid area is not linked from the homepage, you can set those paths. The Supabase anon-key check runs only when the public page contains a Supabase URL and an anon key. The secret scan reads public HTML and same-origin scripts.
No. The check pays your app with Stripe test card 4242 and expects the app to be in Stripe test mode. It does not enter a live card. ShipWatch's own Starter and Studio plans are separate: those are billed through Stripe Checkout.
You give ShipWatch the app URL and two test-account emails and passwords. Those passwords are stored encrypted. The check opens the pages those accounts can reach and saves screenshots of the run. The secret scan fetches the public HTML and same-origin scripts. You can also set an alert email and a Slack incoming webhook. The check does not ask for your Stripe secret key or your Supabase service role key.
The one-time public scan is free. Starter is $19 per month for one monitored app. Studio is $49 per month for five monitored apps. The Free plan does not include a daily check.
You paste a public URL. ShipWatch fetches that page and its same-origin scripts and flags live secret keys such as sk_live_, a Supabase service_role JWT, and OpenAI keys. If the page also contains a Supabase URL and an anon key, it requests tables with only that key. The scan does not log in and does not pay. You can optionally email the report to yourself.
Paste a public URL on the roast page. No ShipWatch account is required. ShipWatch fetches that page once and grades HTTPS, security headers, exposed keys in public JavaScript, whether a Supabase anon key can read rows, links to login, signup, and pricing, the title and social tags, broken links on the homepage, load time and page weight, the favicon, and the mobile viewport tag. You get a grade from A to F, a short roast, and a prompt you can paste into Cursor or Lovable. An optional email sends the report and adds that address to the ShipWatch list. The roast does not sign up, log in, or pay on the target app. The daily monitor does those checks on a schedule.
After a Stripe Checkout subscription exists, open Billing in the dashboard and use the Stripe Customer Portal to cancel. When Stripe sends customer.subscription.deleted, ShipWatch sets that account back to the Free plan. A subscription update with status canceled, unpaid, or incomplete_expired does the same. Apps already saved stay listed. Adding another monitored app then requires a paid plan.