Your AI built it.
Latch it before you ship it.

It depends mostly on your Supabase setup. Lovable apps usually ship the Supabase anon key in the browser, which is normal, so safety comes from Row Level Security (RLS) being on for every table with policies that only let users see their own rows. The common problems are RLS turned off, policies that allow everyone, a service_role key leaking into frontend code, and secret API keys pasted into the client. ShipLatch's free scan checks the public side (leaked keys, exposed .env and .git, headers) in seconds; the paid deep scan tests your RLS after you verify you own the app.

Yes, the anon (or publishable) key is designed to be public and will always be visible in your frontend. It is only safe if Row Level Security is enabled on every table and your policies are correct, because anyone can use that key to query your database directly. The service_role (or sb_secret_) key is different: it bypasses RLS and must never be in client code. If it was, rotate it in the Supabase dashboard.

Open your live site, view the page source and the JavaScript bundles it loads (browser dev tools, Sources tab), and search for key prefixes like sk-, sk_live_, AKIA, ghp_, service_role or sb_secret_. Also try opening /.env and /.git/HEAD on your domain. ShipLatch's free scan does exactly this automatically for the page and up to 20 scripts. If you find a secret key, rotate it with the provider; deleting it from the code is not enough once it has been public.

It loads your public page and up to 20 scripts it references, like a browser, plus up to 3 of its public source maps and one request each to files that should never be public, like /.env, /.git/HEAD and supabase/config.toml. It looks for leaked secrets (OpenAI, Anthropic, Stripe, AWS, GitHub, Supabase service_role and more), exposed files, missing security headers, source maps, and whether you use Supabase or Firebase. It is passive and read-only: no logins, no form submissions, no attacks.

Both unlock copy-paste fix prompts for every finding and the ownership-verified deep scan: a read-only Supabase RLS probe that requests zero rows and reads only row counts, plus Firebase security rules checks. The Fix Pack ($29 one-time) includes one deep scan and 2 re-scans for one app. Stay Locked ($15/month, cancel anytime) includes unlimited re-scans, and an independent scan on every deploy, and we alert you if the grade drops: you get a deploy hook URL for Vercel, Netlify or GitHub Actions, plus an automatic daily re-scan. We only email when the grade drops or a new critical, high or medium finding appears.

No. It is an automated, point-in-time check for the most common mistakes in AI-built apps. It can miss issues and is not a pen test, code review, or SOC 2 / ISO / PCI assessment. Use it to catch the obvious, high-impact problems before launch.

Only scan sites you own or have permission to test. The free scan only reads publicly served files, and the deep scan requires you to prove ownership with a meta tag, a /.well-known/shiplatch.txt file, or a DNS TXT record.