PatchAndShip FAQ
Short answers to common questions before ordering from PatchAndShip: what access is needed, what the refund guarantee covers, which builders and hosts are supported, whether this is a penetration test, and whether a visible Supabase anon key is a problem. Each answer stands alone.
Plain text version: /docs/faq.md
What do you need access to?
Least-privilege access only: collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token. We never ask for passwords, tokens are shared only via a one-time link, and at handoff you revoke our access (we send a checklist).
What if you can't fix it?
If we don't fix every critical issue on our checklist within 48 hours of working access (and, with Fix & Deploy, get your app live on your host), you get a full refund if you ask within 14 days of purchase. Details are in our Refund Policy.
Which platforms do you support?
Apps built with Lovable, Bolt, Replit or Cursor that use Supabase (or a Node/Express backend we can reach). Bolt and Cursor apps deploy to Vercel or Netlify. Lovable apps deploy to Vercel or Netlify, or stay on Lovable hosting. Replit apps stay on Replit hosting. Each order covers one app, one Supabase project (or one Node app) and one deploy target. Apps with more than 25 user-defined tables are declined or quoted separately. Custom backends and VPS/Docker setups are quoted separately.
Is my data safe? Will you break production?
Nothing touches production until a human engineer approves it. We take a backup before migrations when your plan supports it. On Supabase Free we give you a one-command dump to run, or skip schema changes until you upgrade.
Is this a penetration test or a compliance certification?
No. It's a fixed-scope fix for common critical issues in AI-built apps. It isn't a penetration test, a security guarantee or a compliance certification.
Do you add features?
No new features; we fix security issues and, with Fix & Deploy, get your existing app deployed.
Is it a security problem that my Supabase anon key is visible in my frontend?
No. The Supabase anon key (or the newer publishable key, sb_publishable_...) is designed to be public. Your data is protected by Row Level Security policies. The key that must never appear in frontend code is the service_role key (or the newer secret key, sb_secret_...), because it bypasses RLS. PatchAndShip checks the built bundle and git history for that key.
How do I know if my Lovable app's database is exposed?
Check whether every table in the public schema has Row Level Security enabled with owner-scoped policies, then try reading each table with only the public key while logged out. PatchAndShip's paid plans run this test after the owner consents. On Lovable Cloud we run it when the project URL and public key are visible in the built app; otherwise we check the policies directly. The free mini check is passive: it looks only at the public homepage, its scripts and its security headers (for exposed secret keys, missing headers and publicly listed storage links), and nothing else: no database queries, no logins, no changes. It returns a one-page summary within 24 hours.
How much does it cost to fix security issues in a vibe-coded app?
PatchAndShip charges a fixed $149 for the Security Fix (RLS, storage policies, key scan, rotation guidance) and $249 for Fix & Deploy, which adds production deploy, environment variables, auth redirect URLs, and custom domain with SSL. Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase.
Can you deploy my Lovable or Bolt app to my own domain?
Yes. The Fix & Deploy package ($249) deploys one app to Vercel or Netlify, or keeps a Lovable or Replit app on that platform's own hosting with your domain. For Bolt apps, Fix & Deploy deploys to Vercel or Netlify. We don't deploy to Bolt's own hosting. It sets environment variables, updates Supabase Site URL and Redirect URLs for the production domain, connects a custom domain with SSL, and smoke-tests login, signup, and the core flow. Each order covers one app, one Supabase project (or one Node app) and one deploy target.
What does the Supabase October 30, 2026 change mean for my app?
From October 30, 2026, Supabase will stop exposing new tables in the public schema to the Data API (REST and GraphQL) on existing projects until you grant access. Existing tables keep working, and new projects have had this by default since May 30, 2026. Without a grant, the API returns error 42501 "permission denied for table". Our advice: grant only what each role needs, keep RLS on with policies, and never GRANT ALL to anon. If the grant is missing, Postgres rejects the query before RLS comes into play. And a grant without RLS exposes the table.
What's the difference between PatchAndShip and a security scanner?
Scanners report problems. PatchAndShip fixes them: AI agents run the checks and draft the fixes as code changes and SQL migrations. If your project syncs to GitHub, they arrive as a pull request you can review. A human engineer reviews and approves every change before anything reaches production, and we re-run our checks afterwards.
How long does it take?
48 hours from when working access (collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token) is confirmed.