# What PatchAndShip does

Last updated: 2026-10-14

PatchAndShip is a fixed-price service that fixes security problems in web apps built with Lovable, Bolt, Replit and Cursor, mostly on Supabase. It fixes Row Level Security, storage bucket policies and exposed secret keys. With Fix & Deploy it also sets environment variables and auth redirect URLs and deploys the app to production. A human engineer approves every change.

## Who it's for

People who built a web app with Lovable, Bolt, Replit or Cursor, usually on Supabase, and want it safe and live before real users arrive. You don't need to be technical.

## What PatchAndShip fixes

The security issues that AI app builders often leave behind: tables without Row Level Security, public storage of private files, secret keys in your app's code or repo, and secrets in public env variables. With Fix & Deploy we also point auth redirects at production and get the app live on your host with your domain and SSL. On Node/Express apps we also fix missing server-side access checks, open CORS and hard-coded secrets; these are fixed, but they are not “critical” for the 48-hour guarantee.

## What you get

AI agents run the checks and draft the fixes as code changes and SQL migrations. A human engineer reviews and approves every change before anything reaches production. You get a short report of what was found and fixed.

## How it differs from a security scanner

Scanners report problems. PatchAndShip fixes them: AI agents run the checks and draft the fixes as code changes and SQL migrations. If your project syncs to GitHub, they arrive as a pull request you can review. A human engineer reviews and approves every change before anything reaches production, and we re-run our checks afterwards.

## What it isn't

It's a fixed-scope fix for common critical issues in AI-built apps. It isn't a penetration test, a security guarantee or a compliance certification. No new features; we fix security issues and, with Fix & Deploy, get your existing app deployed.

## The guarantee

Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase. The Launch Pack is not covered. “Critical” and “live” are defined in our [Refund Policy](https://patchandship.com/refunds.html#guarantee).

## Affiliation

Not affiliated with Lovable, Bolt, Replit, Cursor or Supabase.

## About PatchAndShip

PatchAndShip fixes security gaps in Lovable, Bolt, Replit and Cursor apps on Supabase, and with Fix & Deploy gets them live. From $149. Within 48 hours of working access or a full refund. Contact: patchandship@gmail.com · https://patchandship.com/ · Not affiliated with Lovable, Bolt, Replit, Cursor or Supabase.