Chart your app's hazards before you launch
Built with Lovable, Bolt, Replit, Cursor or Claude Code? Shipwardly surveys what any visitor's browser can already see, then plots each problem it finds with a plain-English note on why it matters and how to fix it.
Free, no sign-up, nothing to install. We only read what your homepage already sends to every visitor.
-
Stripe secret key in JS bundle Critical
Anyone can read it in your page source and use it to issue refunds or view customer payments.
-
Supabase table readable without login High
Visitors could download rows straight from your database without using your app.
-
Certificate expires in 9 days Medium
If it lapses, browsers will warn people away from your site until it is renewed.
-
No Content Security Policy Low
A useful safety net is missing: nothing limits what an injected script could do on your pages.
What the free survey looks at
Everything here is visible to any visitor's browser. We read it carefully and tell you what it means for your app and your customers.
- Keys that should be secret
- Stripe, OpenAI, Anthropic, AWS and Supabase service keys that sometimes end up in the code sent to every visitor.
- Secure connections
- Whether every visit is forced onto HTTPS, and whether your certificate is valid and not about to expire.
- Security headers
- The instructions your site gives browsers about what to trust, such as a Content Security Policy.
- Cookie settings
- Whether your cookies are protected from being read by scripts or sent to other sites.
- Source maps and mixed content
- Files that expose your original code, and anything loaded over plain HTTP on a secure page.
- Your platform
- Whether you built with Lovable, Bolt, Next.js or Vite, so our advice fits how your app is made.
Keeping what your app exposes at bay
Most trouble in AI-built apps is not a break-in. It is something left exposed by accident: a key in the code, a table anyone can read. We chart each one, mark it clearly and show you the safe way past, so you launch knowing where the hazards are.
-
Secret keys in your JavaScript
Anyone who opens your page source can copy them. We name the key so you can replace it and keep the new one on your server.
-
Database tables anyone can read
Customer data could be downloaded without logging in. Verified scans check your Supabase rules without reading a single row.
-
Missing security headers
Browsers lose their built-in safety nets on your site. We tell you which headers to add, for the platform you use.
-
Source maps left published
Your original code is readable by anyone. It is usually one build setting to switch off.
-
A certificate close to expiry
Browsers will warn visitors away the day it lapses. We flag it 14 days ahead so there is time to renew.
On a real chart, a cardinal buoy tells a skipper which side of a danger is safe water. Every finding in your report does the same job: it says what is exposed, why it matters, and the fix that gets you past it.
From web address to answers in three steps
-
Step 1: Paste your address
Give us the web address of the app you have built. There is nothing to install and no code to share.
-
Step 2: Read your survey
You get a grade from A to F and every finding, rated by severity and explained without jargon or alarm.
-
Step 3: Fix, or ask for help
Each finding comes with clear steps to fix it. If you would rather hand it over, we can audit and fix it for you.
What a browser cannot see
-
Your server
How it is configured, patched and who can reach it.
-
Your database rules
Unless you verify your site, and even then only for Supabase.
-
Anything behind a login
Account pages, admin screens and what each user is allowed to do.
-
Your source code
The logic of your app, beyond what is shipped to the browser.
When you want a person to look properly
Our security audit covers the parts a scan cannot reach. A person reviews your app and writes up every issue in plain English, in order of what to fix first.
- Sign-up, login and password reset
- Database rules in Supabase or Firebase
- API routes and who can call them
- Secrets, keys and environment settings
£395 fixed price, including VAT
The £395 is credited against any fix work you book with us afterwards.
Questions people ask first
Will the scan affect my live app?
No. The free scan fetches your homepage and the JavaScript and CSS it links to, exactly as a visitor's browser would. It does not log in, submit forms or try other paths on your site.
Do I need to own the site?
You should only scan sites you own or have permission to test. Deeper checks only run after you prove you own the domain, with a DNS record or a small file on your site.
What do you do with what you find?
We keep the results so you can read your report. Anonymous scans are deleted after 30 days. If we find a leaked key, we never store it in full: only the first and last four characters, so you can recognise it. We do not store your IP address either, only a keyed hash of it, used to limit how often the scanner and report emails can be used.
Is an A grade a clean bill of health?
No. A good grade means we found none of the common problems we look for from the outside. It does not mean your app is secure, which is why we offer an audit.
Do I have to give my email address?
No. You see your grade and the list of findings straight away. Your email address unlocks the full report, with an explanation and a fix for every finding, and we email you a copy. Once unlocked, the report opens in full for anyone with its link. We keep your address encrypted until you ask us to delete it, and we only send you updates if you tick a separate box and then confirm by email.
Survey your app before your users arrive
Paste your address into the form at the top of this page, see exactly what we check, or ask us about an audit.