In development

Find the security holes in your Supabase + Next.js app before your users do.

AI tools write working apps fast, and often leave the database open. ShipAudit is one command that audits your project and tells you exactly what to fix. It also gives your coding agent the skills to fix it.

$ npx shipaudit audit

FAIL  public.invoices      Row Level Security is disabled
FAIL  public.profiles      policy "read_all" uses USING (true)
FAIL  .env.local           service_role key exposed as NEXT_PUBLIC_
WARN  app/api/export       no auth check before database read
WARN  app/api/stripe       webhook signature is not verified
PASS  storage.buckets      no public buckets

3 failed · 2 warnings · 1 passed    report: shipaudit-report.md

Illustration of the planned output. The tool is not released yet.

One email when it launches. No newsletter, no sharing your address.

What it will check

Tables without RLS

Every table reachable through the public API with Row Level Security off.

Policies that allow everyone

Rules like USING (true) or "any signed-in user" on private data.

Leaked keys

The service_role key or other secrets in client code, public env vars, or git history.

Unprotected routes

API routes and server actions that touch the database without checking who is asking.

Unverified webhooks

Stripe and other webhook handlers that skip signature verification.

Public storage buckets

Buckets and files anyone can list or download.

Planned pricing

Lite

Free

Open source on GitHub.

  • 5 core checks
  • Terminal report

Basic

$29

One-time payment.

  • All checks
  • Markdown report
  • Launch checklist

Pro

$49

One-time payment.

  • Everything in Basic
  • Fix skills for Claude Code and Cursor
  • GitHub Actions workflow

Prices may change before launch based on feedback.

Questions

Does it send my code or data anywhere?
No. It is designed to run on your machine and read your project and database schema locally.
Is this a replacement for a security review?
No. It catches common, known mistakes. It does not prove an app is secure.
Which stacks?
Supabase with Next.js first. Tell us what you use when you sign up and reply to the launch email.
When does it launch?
No date yet. The waitlist decides whether it gets built.