Question 1

Is my Supabase anon key safe to expose?

Accepted Answer

The anon key is designed to be public, so on its own it is fine. It becomes dangerous when Row-Level Security is off, because then that public key can read every row in your tables. Safe key plus RLS on is fine. Safe key plus RLS off is an open database.

Question 2

How do I check if my AI-built app is secure?

Accepted Answer

Paste your live app URL into ShipShield. We load the page like a normal visitor, read the public JavaScript and response headers, and report exposed secret keys, missing security headers and public config files. It is read-only, takes about a minute, and needs no login or source code.

Question 3

My AI tool already scans my app. Why do I need ShipShield?

Accepted Answer

Built-in scans only cover apps made with that one tool, and only run when you ask. They also tend to check whether a protection is switched on rather than whether it is configured correctly. ShipShield watches every app you build, whichever tool made it, and re-checks automatically after each deploy.

Question 4

Do I need to know how to code to use ShipShield?

Accepted Answer

No. Every issue is explained in plain English, with why it matters and what could happen. Each one comes with a ready-made prompt you paste straight into Lovable, Bolt, Replit or Cursor to fix it.

Question 5

Is scanning safe for my live app?

Accepted Answer

Yes. ShipShield only reads what your app already serves publicly. It is read-only and rate-limited. It never writes, deletes, logs in, submits forms or sends attack traffic.

Question 6

What does ShipShield actually check for?

Accepted Answer

Leaked secret keys in your JavaScript bundle such as Stripe sk_live_, Supabase service_role, OpenAI and AWS keys. Publicly readable database tables. Exposed .env, .git and source map files. Missing security headers. Open CORS. Unprotected admin routes.

Contact

Support and billing

Privacy requests

Security reports