Skip to content
LockShip

For Lovable, Bolt, v0, Replit, and Cursor apps

See what a hacker sees in 60 seconds.

Paste your app URL. LockShip reads it the way a stranger would — open tables, leaked keys, exposed files — then tells you how to fix it and, if you pass, hands you a Launch Safe badge.

Nothing runs until you prove you control the domain. We never write to your database.

Launch
Safe
Verified
Certificate preview

Example, not your data

Anonymous read on public.payments

A stranger with the anon key can fetch a row. Columns: id, email, amount, stripe_customer_id. Values stay redacted.

alter table public.payments enable row level security;

Point-in-time. Not a pentest. Not a guarantee.

01

Prove the domain

DNS TXT, a meta tag, or /.well-known/lockship.txt. No proof, no scan.

02

Read-only scan

About a minute. We fetch at most one row per table and never insert, update, or delete.

03

Fix, re-scan, badge

The $39 report includes the prompt and the SQL. A passing re-scan issues the badge.

What the free scan looks for

Platform

Sees whether the app looks like Lovable, Bolt, v0, Replit, Cursor, or a custom build, and writes the fix prompt in that builder’s voice.

Supabase and Firebase

Finds the public anon key or Firebase config in the bundle, then tries an anonymous read of each table. One redacted row is the proof. Nothing is written.

Leaked secrets

Looks for Stripe live keys, OpenAI keys, AWS keys, service_role keys, and database URLs sitting in client JavaScript.

Exposed files

Requests /.env and /.git. If a single-page app returns its homepage for every path, that does not count.

Headers, CORS, TLS

Checks CSP, HSTS, clickjacking protection, wildcard CORS, cookie flags, and the certificate.

Open API routes

Follows /api and Supabase edge paths found in the bundle and GETs them with no session.

Certificates launching soon

The first scan is free: a score and the single worst finding. Join the waitlist for the certificate and Monitor.

Free summary

$0

Score, severity counts, and one finding in plain English. Proof and fixes stay locked until checkout opens.

Not on sale yet

Certificates launching soon

Join the waitlist. The free scan and the one-finding summary stay open. The $39 certificate and the $9/month monitor are not on sale yet.

We’ll write when checkout opens. Nothing is charged until then.

Questions worth asking

Is this a pentest?
No. It is a best-effort, point-in-time, read-only check of the mistakes vibe-coded apps make most often. It will miss things a human tester would find.
Do you write to my database?
No. Probes are GET and HEAD only. Supabase reads use limit=1. Firebase reads use pageSize=1 or limitToFirst=1. Values are redacted before they are stored.
Why prove I own the domain?
So nobody can point LockShip at a site they do not control and pull a row out of it.
What do you store?
The URL, the score, redacted proofs, and your email if you type one. Full secret values and full rows are not kept. See the privacy note.

Not ready to paste a URL?

Join the waitlist. The address is stored in the database. This build does not send email.

Read the disclaimer before you rely on a badge.