10.3%
of Lovable apps scanned exposed data without login
A researcher checked 1,645 Lovable-built apps and found 170 of them exposed database data to anyone, no account needed (CVE-2025-48757).
source: mattpalmer.io ↗Early access · free launch scores for the first apps in line
Ship it.
We'll vouch for it.
AI-built apps ship fast, and they leak data and API keys just as fast. ShipVouch's agents prove the real holes before strangers find them, hand you fix prompts for the tool you built with, then re-test and vouch for you in public.
✓
You're on the list.
We'll email you when your free launch score is ready to run. Next step will be a quick ownership check (DNS record or a file on your site).
For apps built withCursorLovableBoltReplitv0Claude Code
$ shipvouch check https://myapp.example
→ ownership verified via DNS TXT
→ agents: auth · data · keys · cost · seo
✗ PROVEN read profiles while logged out
✗ PROVEN user B reads user A's invoices
! RISK AI key in JS bundle, no spend cap
! RISK no rate limit on /api/generate
✓ PASS HTTPS, headers, env separation
✓ PASS meta tags, sitemap, LCP budget
launch score54/100
↳ 4 fix prompts ready for Lovable
// the problem
Vibe-coded apps are leaking. This is documented.
Shipping in a weekend is the superpower. Shipping your users' data and your API bill along with it is the bug.
400+
exposed secrets across 5,600 vibe-coded apps
Escape.tech scanned 5,600 publicly available vibe-coded apps and found 400+ exposed secrets and 2,000+ high-impact vulnerabilities.
source: escape.tech ↗~€54K
in 13 hours from one unrestricted key
An unrestricted Firebase browser key that could reach Gemini APIs ran up a bill of about €54,000 in 13 hours. Budget alerts arrived hours late.
source: Hacker News ↗Scanners tell you something might be wrong. ShipVouch shows you what a stranger can actually do.
// how it works
From "it works on my URL" to vouched.
Four steps. No SDK, no agent to install, no repo access required.
01
Submit & prove it's yours
Drop your app URL, then verify ownership with a DNS TXT record or a file at /.well-known/. No proof, no test.
02
Agents attack (politely)
AI agents poke your app like a curious stranger and like a nosy signed-in user. When they find a hole, they prove it with a real request instead of guessing.
03
Report + fix prompts
Get a ranked report and copy-paste fix prompts written for your tool: Cursor, Lovable, Bolt, Replit, v0 or Claude Code.
04
Fix, re-test, get vouched
Paste the prompts, ship the fix, hit re-test. Pass, and you get a public Vouched by ShipVouch badge for your site.
// what we check
The stuff that actually bites at launch.
Not a 400-item compliance checklist. The handful of things that leak data, burn money or tank your launch.
Security & data exposure
Can a stranger read your database? Can user B see user A's stuff? We try it and show you the receipts.
- Logged-out reads & writes (RLS / security rules)
- Cross-account access between signed-in users
- Auth bypasses and exposed admin routes
Leaked keys
Secrets in JS bundles, source maps, public env files and API responses, plus which ones actually work.
- Service-role / admin keys in the frontend
- AI provider, payment and email keys
- Public-by-design keys that are over-privileged
Cost & abuse protection
So a leaked key doesn't turn into a surprise bill.
- Spend caps & budgets
- Rate limits on paid endpoints
- API key restrictions
Deploy & env hygiene
The boring stuff that breaks loudly.
- Dev/test data in prod
- Debug endpoints & source maps
- HTTPS, headers, CORS
SEO & performance basics
Because launch day is also discovery day.
- Titles, meta, OG images
- Sitemap, robots, indexability
- Core Web Vitals budget
// pricing
One-time checks. No seat math.
Payments aren't live yet. Join the early access list and we'll let you know the moment they are.
Free score
See where you stand in a few minutes.
$0
- Launch score out of 100
- Your single most important issue
- Ownership-verified, outside-in test
Launch Check
Everything you need to fix it before you post it.
$49one-time
- Full report, ranked by impact
- Fix prompts tailored to your tool
- Security, keys, cost, deploy, SEO & perf
- One re-test after you fix
Most popular
Verified
Proof your app holds up, and a badge that says so.
$149one-time
- Everything in Launch Check, plus:
- Checks behind login with test accounts
- Proof of each exploit (request + response)
- Public "Vouched by ShipVouch" badge
- 30 days of re-tests
Monitoring ADD-ON
Every deploy is a new app. We re-run the checks on a schedule and ping you when something regresses.
$19/mo
Join the early access list
Prices in USD. Early access pricing may change before launch.
// the badge
Show users you did the homework.
Pass a Verified check and drop the badge in your footer. It links to a public page showing what we tested and when.
- Links to a live verification page, not a static image
- Shows the date of your last passing test
- Pulled automatically if your app regresses and you don't fix it
<a href="https://shipvouch.com/v/your-app"><img src="…/badge.svg" alt="Vouched by ShipVouch"></a>
// faq
Questions, answered.
Do you test any app someone submits?
No. We only test apps you prove you own, via a DNS TXT record or a verification file served from your domain. Our agents only touch the domain you verified, and for logged-in checks we use test accounts you create for us. We don't try to break other people's stuff, and we won't help you do it either.
Does passing mean my app is 100% secure?
No, and anyone who promises that is selling something. A ShipVouch pass means your app passed our checks at the time we ran them, covering the common, high-impact issues we test for. It isn't a guarantee or certification that your app has no vulnerabilities, and it doesn't replace a full professional security audit for apps handling highly sensitive data.
New deploys can introduce new problems, which is why Verified includes 30 days of re-tests and Monitoring exists.
Which tools do you support?
We test the deployed app, so anything with a public URL works. Fix prompts are tailored for Cursor, Lovable, Bolt, Replit, v0 and Claude Code, with common backends like Supabase and Firebase in mind. Built with something else? You still get clear, generic fix instructions.
How is this different from a regular scanner?
Scanners flag things that look risky. Our agents try to actually do the bad thing, like reading your data logged out or as another user, and show you the exact request that worked. Fewer false alarms, more "oh no, fix that now."
Do you need access to my code or repo?
No. Checks run against your live app from the outside, just like a real attacker would see it. For Verified, you give us test logins so we can check what signed-in users can reach.
Will testing break my app or my data?
Checks are designed to be non-destructive: we prove access with reads and harmless marker writes, and we rate-limit ourselves. We still recommend pointing logged-in checks at test accounts, not real customers.
When can I actually use it?
We're onboarding early access in batches. Join the list and you'll get your free launch score as soon as your spot opens up.
// before you post it on X
Find the hole before a stranger does.
Get your free launch score and a spot on the early access list.
✓
You're on the list.
We'll email you when your free launch score is ready to run. Go build something.