Ship your app.
Not your users’ data.

Least-privilege access only: collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token. We never ask for passwords, tokens are shared only via a one-time link, and when we hand the work back, we remove our access and send you a checklist to confirm it's gone. If we need your code, it must be in a GitHub repository; we don't accept code by email or as a zip file. Security Fix and Fix & Deploy need write access to fix your app, with the lowest role that works. Before we apply any change to your production app, we send you what we plan to change and wait for your written OK.

If we don't fix every critical issue on our checklist within 48 hours of working access (and, with Fix & Deploy, get your app live on your host), you get a full refund if you ask within 14 days of purchase. Details are in our Refund Policy.

Apps built with Lovable, Bolt, Replit or Cursor that use Supabase (or a Node/Express backend we can reach). A backend we can reach has its code in your GitHub repo (or your Replit project) and already runs on a host you control: we fix it there, but we don't set up or host servers. Bolt and Cursor apps deploy to Vercel or Netlify: we deploy the frontend, and deploying a separate server is quoted separately. Lovable apps deploy to Vercel or Netlify, or stay on Lovable hosting. Replit apps stay on Replit hosting. Each order covers one app, one Supabase project (or one Node app, as defined in our Terms) and one deploy target. Apps with more than 25 user-defined tables are declined or quoted separately. Custom backends and VPS/Docker setups are quoted separately. More on Replit: Who can secure my Replit app? More on Cursor: Who can secure my Cursor app?

Nothing touches production until a human engineer approves it. Before we apply any change to your production app, we send you what we plan to change and wait for your written OK. We take a backup before migrations when your plan supports it. On Supabase Free we give you a one-command dump to run, or skip schema changes until you upgrade.

No. It's a fixed-scope fix for common critical issues in AI-built apps. It isn't a penetration test, a security guarantee or a compliance certification.

No new features; we fix security issues and, with Fix & Deploy, get your existing app deployed.

The security issues that AI app builders often leave behind: tables without Row Level Security, public storage of private files, secret keys in your app's code or repo, and secrets in public env variables. With Fix & Deploy we also point auth redirects at production and get the app live on your host with your domain and SSL. On Node/Express apps we also fix missing server-side access checks and open CORS; these are fixed, but they are not "critical" for the 48-hour guarantee. Secret keys hard-coded in a Node app's code or committed to its repo are critical, as on any app.

Usually because Row Level Security was never switched on. The app works in preview either way, so nobody notices. In Sentris's scan of public GitHub repositories, 57% of Lovable repos had a table in the public schema with Row Level Security switched off, compared with 21.7% of Supabase repos with no AI-tool marker. Sentris may become a referral partner.

No. The Supabase anon key (or the newer publishable key, sb_publishable_...) is designed to be public. Your data is protected by Row Level Security policies. The key that must never appear in frontend code is the service_role key (or the newer secret key, sb_secret_...), because it bypasses RLS. PatchAndShip checks the built bundle and git history for that key.

Check whether every table in the public schema has Row Level Security enabled with owner-scoped policies, then try reading each table with only the public key while logged out. PatchAndShip's paid plans run this test after the owner consents. On Lovable Cloud we run it when the project URL and public key are visible in the built app; otherwise we check the policies directly. The free emailed mini check is passive: it looks only at the public homepage, its scripts and its security headers, and nothing else. It flags exposed secret keys, missing headers and public storage links found in the code (the bucket itself is never opened or listed). No database queries, no logins, no changes. It returns a one-page summary within 24 hours. For a result in a few seconds, run the free instant check at patchandship.com/check.html.

PatchAndShip charges a fixed $149 for the Security Fix (RLS, storage policies, key scan, rotation guidance) and $249 for Fix & Deploy, which adds production deploy, environment variables, auth redirect URLs, and custom domain with SSL. Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase.

Yes. The Fix & Deploy package ($249) deploys one app to Vercel or Netlify, or keeps a Lovable or Replit app on that platform's own hosting with your domain. For Bolt apps, Fix & Deploy deploys to Vercel or Netlify. We don't deploy to Bolt's own hosting. It sets environment variables, updates Supabase Site URL and Redirect URLs for the production domain, connects a custom domain with SSL, and smoke-tests login, signup, and the core flow.

From October 30, 2026, Supabase will stop exposing new tables in the public schema to the Data API (REST and GraphQL) on existing projects until you grant access. Existing tables keep working, and new projects have had this by default since May 30, 2026. Without a grant, the API returns error 42501 "permission denied for table". Our advice: grant only what each role needs, keep RLS on with policies, and never GRANT ALL to anon. If the grant is missing, Postgres rejects the query before RLS comes into play. And a grant without RLS exposes the table.

Scanners report problems. PatchAndShip fixes them: AI agents run the checks and draft the fixes as code changes and SQL migrations. If your project syncs to GitHub, they arrive as a pull request you can review. A human engineer reviews and approves every change before anything reaches production, and we re-run our checks afterwards.

48 hours from when working access (collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token) is confirmed.

We fix them. AI agents run the checks and draft the fixes as code changes and SQL migrations. A human engineer reviews and approves every change before anything reaches production, and you also get a short report. Before we apply any change to your production app, we send you what we plan to change and wait for your written OK.

Security Fix ($149) fixes RLS, storage policies and exposed keys and includes key rotation guidance. Fix & Deploy ($249) adds the production deploy to one host (Vercel or Netlify, or Lovable or Replit hosting, depending on your builder): env vars, Supabase auth redirect URLs, custom domain with SSL, and a smoke test.

The free checks only look at what your app shows the public. The instant check is an automated scan of your homepage and its scripts, and it doesn't store your results. The emailed mini check is a passive check of your public homepage, scripts and security headers, with a one-page summary within 24 hours. Neither one looks inside your database. The $49 Database Check does. With your permission, a person goes through every table and storage bucket in your app's Supabase project (or Lovable Cloud backend) and explains each access rule in plain English (Row Level Security policies and grants). You get a red, yellow and green report with the order to fix things in.

No. It's read-only: we look and report, and we change nothing. You run a read-only script we send you and reply with the results and your Supabase Security Advisor list (or Lovable's security scan). No passwords, no keys, and we don't log in to your account. AI agents run the checks and a human engineer reviews and approves every report before you get it. You get the report within 24 hours of working access, or a full refund. If you want the problems fixed, that's the Security Fix or Fix & Deploy.

If you buy a Security Fix ($149) or Fix & Deploy ($249) for the same app within 14 days of buying your Database Check, the full $49 counts toward it, so you pay $100 or $200. Use the upgrade link we send you, or the one-time $49 code we email you at checkout. Before work starts, we check the credit by hand against your $49 payment. If you already paid full price within those 14 days, ask us and we refund the $49. The credit can be used once, only for the app in your Database Check order and only by the person or business that bought it. It can't be transferred or exchanged for cash, and it isn't offered on marketplaces. Details are in our Refund Policy.

When working access is confirmed. It pauses while we're waiting on you, and steps only you can take, like rotating keys or changing DNS, don't count toward the 48 hours.