Is your app Shippable?
Paste your URL. In a few minutes Patchy finds what your app is leaking, like user data and API keys, and hands you the fix.
No app handy?
- 1Paste your URL
- 2Add one tag (~2 min)
- 3Get the fixes
First app freeSee the verdict before you sign up
Still building?npx shippable-dev scan localhost:5173
Shippable in under a minute
Vibe-coded apps spring leaks
Your AI builder ships features fast. It never stops to ask "should this table be public?" So Patchy asks for you.
Unlocked databases
RLS left off. The public key in your page source reads every row of every table.
Secret keys in the browser
Stripe, OpenAI or Supabase admin keys baked into JavaScript every visitor downloads.
Holes in the code itself
Edge functions anyone can call, payment webhooks that never check the signature, public buckets. Your AI wrote them in good faith.
Patchy doesn't guess. He points.
Other tools flag a setting and hope. Patchy shows you the actual leak, read-only, so you see exactly what a stranger could see.
Table 'users' is readable by anyone
Your users table has no Row-Level Security policy. The public anonymous key embedded in your site's front-end can query it directly — no login required.
Stripe secret key exposed in the browser
A live Stripe secret key (not the safe publishable one) was found inside a JavaScript file your app ships to every visitor.
From URL to patched in a few minutes
- Step 1
Paste your URL.
- Step 2
Prove it's yours. One prompt adds a harmless tag.
- Step 3
Patchy inspects, read-only. He never touches a thing.
- Step 4
Paste the patch. SQL or a prompt for your AI tool.
With you from the first prompt to long after launch.
Security isn't a checklist for launch day. Patchy fits in while you build, before you ship, and once you're live.
- 1While you build
From the first prompt
Your AI agent scans your dev server after each change. No tag, no account, and your code stays on your machine.
Loop Patchy in → - 2Before you ship
Ready to launch
Paste your live URL and add one tag. You get every leak with proof and a fix to paste into your AI tool.
Scan my app → - 3After you ship
Live with users
Patchy re-checks every week and emails you if something new starts leaking. Add a badge, or a check on every pull request.
Keep watch →
Wherever you build, Patchy shows up.
Paste a URL in your browser, run one command in your terminal, or let your AI agent call him while it codes. Same checks, same proof, same patches.
Checks your live app from the outside. Database, keys, files, headers, CORS, email spoofing.
Shipped? He keeps an eye on the place.
Apps change every time you prompt. Patchy re-checks them every week and emails you if something new starts leaking.
Weekly or daily re-scans + alerts
Watch is included with every app, weekly or daily. Your first app is free, extra apps are $1 a month. One email when something new shows up. Silence when nothing does.
What changed
Re-scan and see it at a glance: what you fixed, what's new, what's still open.
- 2 fixed
- 1 new
- 3 still open
Checked by Shippable
Put the badge on your site. It links to your latest clean check, so visitors can see it's real.
Next: the crew tries to break in.
The free scan finds what's already leaking. The AI Red Team goes further: agents actively try to break your logins, checkout and inputs, so you can plug the holes first. Scoped from your scan, only on apps you've proven are yours.
When it opens, it's $5 per run from prepaid credit, with a spending cap you set first. See pricing
One email when early access opens. Nothing else.
Free forever. Really.
Your first app (unlimited scans and watch), unlimited code scans in the CLI and the AI agent tools cost nothing. Each extra app is $1 a month, and the heavy stuff is by the unit, with a cap you set.
