ShipSafe

Sample report · example data

What the $9 report looks like.

This is the full report for a made-up app. Yours uses evidence from your own site.

Launch pricing — goes to $49 soon.

Scan your own app

Summary

5 issues found: 1 critical, 1 high, 3 medium, 0 low.

Fix the critical and high items first. They affect security and trust directly.

https://demo-app.example · scanned 10/20/2026, 6:06:00 PM

7-day plan

  1. Day 1Possible exposed OpenAI API key in client-side codeCritical
  2. Days 3-5Supabase detected: verify Row Level Security on every tableMedium
  3. Days 1-2Missing 5 security headersHigh
  4. Days 3-5Incomplete Open Graph / social preview tagsMedium
  5. Days 3-5No privacy policy link foundMedium

All findings

01CriticalSecurity

Possible exposed OpenAI API key in client-side code

What this means
Anything in your frontend JavaScript is public. Bots scrape bundles for keys within minutes of deploy.
Business impact
Financial loss (API bills), data theft.
Evidence
OpenAI API key: sk-pro…x9Q (164 chars)  — found in index-4f2a9c.js
How to fix
  1. 1Revoke / rotate this key immediately.
  2. 2Move the call to a server-side route and read the key from a server-only env var.
  3. 3Never prefix secrets with VITE_ / NEXT_PUBLIC_.
Copy-paste AI fix prompt
I am building an app using an AI builder (Lovable / Bolt / Cursor / Replit / v0).
My app URL is: https://demo-app.example

Issue found:
Possible exposed OpenAI API key in client-side code

Evidence:
OpenAI API key: sk-pro…x9Q (164 chars)  — found in index-4f2a9c.js

Risk:
Financial loss (API bills), data theft.

Please fix this issue without breaking existing functionality.
Use secure best practices, avoid exposing secrets in the frontend,
and explain exactly what you changed.

Suggested approach:
1. Revoke / rotate this key immediately.
2. Move the call to a server-side route and read the key from a server-only env var.
3. Never prefix secrets with VITE_ / NEXT_PUBLIC_.
02MediumDatabase/API

Supabase detected: verify Row Level Security on every table

What this means
The anon key is public by design, but tables without RLS are readable/writable by anyone.
Business impact
Full exposure of user data if RLS is missing.
Evidence
Supabase anon key (public by design): eyJhbG…Qs8 (found in index-4f2a9c.js)
How to fix
  1. 1Enable RLS on every table.
  2. 2Scope policies to auth.uid().
Copy-paste AI fix prompt
I am building an app using an AI builder (Lovable / Bolt / Cursor / Replit / v0).
My app URL is: https://demo-app.example

Issue found:
Supabase detected: verify Row Level Security on every table

Evidence:
Supabase anon key (public by design): eyJhbG…Qs8 (found in index-4f2a9c.js)

Risk:
Full exposure of user data if RLS is missing.

Please fix this issue without breaking existing functionality.
Use secure best practices, avoid exposing secrets in the frontend,
and explain exactly what you changed.

Suggested approach:
1. Enable RLS on every table.
2. Scope policies to auth.uid().
03HighSecurity

Missing 5 security headers

What this means
Headers tell browsers to block common attacks.
Business impact
Easier clickjacking and script injection.
Evidence
Missing: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
How to fix
  1. 1Add headers at your host.
  2. 2Start with CSP in report-only mode.
Copy-paste AI fix prompt
I am building an app using an AI builder (Lovable / Bolt / Cursor / Replit / v0).
My app URL is: https://demo-app.example

Issue found:
Missing 5 security headers

Evidence:
Missing: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy

Risk:
Easier clickjacking and script injection.

Please fix this issue without breaking existing functionality.
Use secure best practices, avoid exposing secrets in the frontend,
and explain exactly what you changed.

Suggested approach:
1. Add headers at your host.
2. Start with CSP in report-only mode.
04MediumSEO

Incomplete Open Graph / social preview tags

What this means
OG tags control how your link looks when shared.
Business impact
Shared links get far fewer clicks.
Evidence
Missing: og:image, og:description
How to fix
  1. 1Add og:title, og:description, og:image (1200x630).
Copy-paste AI fix prompt
I am building an app using an AI builder (Lovable / Bolt / Cursor / Replit / v0).
My app URL is: https://demo-app.example

Issue found:
Incomplete Open Graph / social preview tags

Evidence:
Missing: og:image, og:description

Risk:
Shared links get far fewer clicks.

Please fix this issue without breaking existing functionality.
Use secure best practices, avoid exposing secrets in the frontend,
and explain exactly what you changed.

Suggested approach:
1. Add og:title, og:description, og:image (1200x630).
05MediumTrust

No privacy policy link found

What this means
You collect emails, so a privacy policy is expected.
Business impact
Legal exposure and lower conversion.
Evidence
No link containing 'privacy'
How to fix
  1. 1Add a privacy policy page and link it in the footer.
Copy-paste AI fix prompt
I am building an app using an AI builder (Lovable / Bolt / Cursor / Replit / v0).
My app URL is: https://demo-app.example

Issue found:
No privacy policy link found

Evidence:
No link containing 'privacy'

Risk:
Legal exposure and lower conversion.

Please fix this issue without breaking existing functionality.
Use secure best practices, avoid exposing secrets in the frontend,
and explain exactly what you changed.

Suggested approach:
1. Add a privacy policy page and link it in the footer.

Scan notes

  • Sample data for illustration only. No real app was scanned.

ShipSafe performs passive, non-invasive checks only. It is not a penetration test and cannot guarantee your app is secure. This is a sample report with example data.