PatchAndShip security and access policy
Here's PatchAndShip's access policy. Least-privilege access only: collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token. We never ask for passwords, tokens are shared only via a one-time link, and at handoff you revoke our access (we send a checklist).
Plain text version: /docs/security-and-access.md
Access we ask for
| Service | Access |
|---|---|
| GitHub | Collaborator access on the one repository. |
| Supabase | An invite to your Supabase organization with the lowest role your plan allows (on Free and Pro plans that access covers the whole organization, so revoke it right after delivery; we send a checklist), never your password. |
| Lovable | For Lovable, invite us to your project as an Editor by email from Share; if you're on Lovable Cloud, that one invite covers the backend too, so no separate Supabase invite is needed. Remove us from Share > Project access when we're done. On a Business or Enterprise workspace, an admin may need to allow outside collaborators first. |
| Bolt | For Bolt, invite us to your project as an Editor from Share; remove us from the same menu when we're done. On a Teams plan, an admin needs to turn on external collaboration first. |
| Vercel | For Vercel, you don't need to buy a seat or invite us to your team: we give you a deploy-ready repo and an env-var checklist, then either walk you through a short guided handoff with the exact clicks, or use a scoped, expiring Vercel access token you share through a one-time link, never your password. |
| Netlify | For Netlify, you don't need to add us to your team: we give you a deploy-ready repo and an env-var checklist and walk you through a short guided handoff with the exact clicks, never your password. |
| Replit | For Replit, invite us to your project as an Editor (on a workspace, the lowest editing role is Guest). Collaborators can see your Secrets' names and values, so you must rotate every Secret after delivery. Removing us and rotating your Secrets are both on the revoke checklist we send. |
In Supabase's platform access control, the Developer role can view Auth URL Configuration but cannot update it. Owner or Administrator is required. (Supabase Docs: Access Control) So if our role can't change the Supabase Site URL and redirect URLs, you make that change, and we give you exact instructions.
What we never accept
We never accept passwords, database passwords, long‑lived Full Account tokens, or secrets sent by email, chat or form. Tokens are shared only via a one‑time link.
How changes reach production
AI agents run the checks and draft the fixes as code changes and SQL migrations. A human engineer reviews and approves every change before anything reaches production. We take a backup before migrations when your plan supports it. On Supabase Free we give you a one‑command dump to run, or skip schema changes until you upgrade.
Where your setup supports it, we apply changes to a staging branch or preview deploy first. Before anything reaches production we write down a rollback plan: how to revert the code change and reverse each migration. Anything involving real user data or payments is handled by a human engineer, not an AI agent. A human also approves every schema migration and production deploy.
Handoff
You revoke our access at handoff, and we keep no copies of secrets. We send you a checklist for that.
Replit docs: Multiplayer collaborators invited to a Replit project can see both the names and the values of its Secrets. (Replit Docs: Secrets) Required: on Replit, rotate every Secret after handoff. It's on the revoke checklist we send.
Permission
Paid checks run only after the owner consents. For the free mini check, the app owner (or an authorized person) must consent. We never scan or publicly name apps without the owner's permission.
How we handle personal data: Privacy Policy.