60-second leak check
Paste your URL. ShipSafe reads your shipped bundle for exposed API keys and probes your Supabase tables for the one mistake that dumps your whole user list to the internet — missing Row Level Security.
We fetch your HTML and every linked JS bundle and regex it for live credentials — Stripe secret keys, OpenAI/Anthropic keys, AWS, GitHub tokens, and Supabase keys. Each one is decoded just far enough to judge severity (a service_role key in your bundle is a full database bypass) and then redacted before it ever hits your screen.
Using only your public anon key — the one already in your bundle — we ask your database which tables answer back. A table that returns rows to an anonymous request is readable by anyone on the internet. We report the row count and column names, never the values, and hand you the exact SQL to lock it down.