What ShipWatch checks
Daily browser checks for apps built with Lovable, Bolt, Cursor, and Replit. Each run covers signup, login, a Stripe test checkout, whether paid access was granted, a cross-user data-leak check, and exposed API keys.
Who it is for
Founders and builders shipping with Lovable, Bolt, Cursor, or Replit. You add an app you own, plus two test accounts on that app. ShipWatch does not need your Stripe secret key or a Supabase service role key.
Each daily run
Signup and login
The stored test account can create a session. If the account already exists, the check logs in instead of treating that as a failure.
Stripe test checkout
The run opens the paywall and pays with Stripe test card 4242. This is test mode only. ShipWatch does not enter a live card on your app.
Paid access granted
After checkout, the check opens the members area. A thank-you page is not enough. The account has to show the paid state.
Cross-user data leak
The check logs in as a second test user and requests the first user's private pages. If that second user can read them, the run fails. That is the gap row level security is supposed to close, including a table with RLS off or a policy of using (true).
Exposed API keys
The public HTML and same-origin scripts are scanned for live secrets such as sk_live_, a Supabase service_role key, and OpenAI keys. A Supabase anon key by itself is not treated as a secret.
A failure email includes a short explanation and a prompt you can paste into Cursor or Lovable. Slack is optional. A weekly note is sent when the last one is more than seven days old.
Pricing
The one-time public scan is free. Starter is $19 per month for 1 app. Studio is $49 per month for 5 apps. The Free plan does not include a daily check.
Free one-time scan
Paste a public URL. ShipWatch reads the page and its same-origin scripts for live secret keys. If it finds a Supabase URL and an anon key, it requests tables with only that key. The scan does not log in and does not pay.