# PatchAndShip: full guide > PatchAndShip (https://patchandship.com) fixes the security holes in web apps built with AI tools (Lovable, Bolt, Replit or Cursor) and, with Fix & Deploy, gets them live. In plain words: your app works in preview, and we make sure it holds up in production. Fixed price from $149. Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase. This file is the long version of https://patchandship.com/llms.txt. It repeats what the website says, in plain text, for AI assistants and search tools. Last updated: 2026-10-14. ## Who it is for People who built a web app with Lovable, Bolt, Replit or Cursor, usually on Supabase, and want it safe and live before real users arrive. You do not need to be technical. ## What we fix - Supabase Row Level Security (RLS): switched on for every table, with policies so each user only reaches their own rows. - Storage: private buckets for private files, with access policies. - Secret keys: we scan the shipped JavaScript bundle and repo history for service_role keys and other secrets, remove them and tell you exactly which keys to rotate. - Env variables: secrets moved out of public (for example VITE_) variables. - Auth (Fix & Deploy only): Supabase Site URL and redirect URLs pointed at production instead of the preview. - Node/Express backends: missing server-side access checks, open CORS and hard-coded secrets. - Deploy (Fix & Deploy only): env vars on the host, custom domain with SSL, build fixes, and a smoke test of login, signup and your core flow. Targets: Vercel, Netlify, or Lovable/Replit hosting. ## How it works 1. Pay for a plan with Stripe. We email you the intake form. 2. Give least-privilege access: collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token. We never ask for passwords, tokens are shared only via a one-time link, and at handoff you revoke our access (we send a checklist). 3. AI agents run the checks and draft the fixes as code changes and SQL migrations. If your project syncs to GitHub, they arrive as a pull request you can review. A human engineer reviews and approves every change before anything reaches production. We take a backup before migrations when your plan supports it. On Supabase Free we give you a one-command dump to run, or skip schema changes until you upgrade. 4. You get a short report of what was found and fixed. You revoke our access at handoff; we keep no copies of secrets. ## Packages and prices (USD, one app per order) - Security Fix: $149 one-time, done within 48 hours of working access. RLS fixes on all tables, storage policies, bundle and repo key scan, key rotation guidance, short report. Checkout: https://buy.stripe.com/14AfZjgFxgJnbmW2ki8Zq00 - Fix & Deploy: $249 one-time, done within 48 hours of working access (recommended). Everything in Security Fix plus production deploy: env vars, auth redirect URLs, custom domain and SSL, smoke test. Checkout: https://buy.stripe.com/3cI8wRfBteBf62C5wu8Zq01 - Launch Pack add-on: $149 one-time (https://buy.stripe.com/fZu6oJbld1Ot62C6Ay8Zq02) or $99/month (https://buy.stripe.com/6oU7sN74X64J8aK3om8Zq03). Product Hunt and Reddit launch posts, SEO title, meta and landing copy, and a curated directory submission list (monthly: new posts and a refreshed list). - Free mini security check: free. The free mini check is passive: it looks only at the public homepage, its scripts and its security headers (for exposed secret keys, missing headers and publicly listed storage links), and nothing else: no database queries, no logins, no changes. It returns a one-page summary within 24 hours. The app owner (or an authorized person) must consent. Ask at patchandship@gmail.com. ## Guarantee Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase. The Launch Pack is not covered. The clock starts when access is confirmed. "Critical" and "live" are defined in our Refund Policy: https://patchandship.com/refunds.html#guarantee ## Scope limits One app, one Supabase project (or one Node app) and one deploy target per order. Apps with more than 25 user-defined tables are declined or quoted separately. No new features. Custom backends and VPS/Docker setups are quoted separately. This is a fixed-scope fix of common critical issues, not a penetration test, security guarantee or compliance certification. ## Frequently asked questions ### What do you need access to? Least-privilege access only: collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token. We never ask for passwords, tokens are shared only via a one-time link, and at handoff you revoke our access (we send a checklist). ### What if you can't fix it? If we don't fix every critical issue on our checklist within 48 hours of working access (and, with Fix & Deploy, get your app live on your host), you get a full refund if you ask within 14 days of purchase. Details are in our Refund Policy. ### Which platforms do you support? Apps built with Lovable, Bolt, Replit or Cursor that use Supabase (or a Node/Express backend we can reach). Bolt and Cursor apps deploy to Vercel or Netlify. Lovable apps deploy to Vercel or Netlify, or stay on Lovable hosting. Replit apps stay on Replit hosting. Each order covers one app, one Supabase project (or one Node app) and one deploy target. Apps with more than 25 user-defined tables are declined or quoted separately. Custom backends and VPS/Docker setups are quoted separately. ### Is my data safe? Will you break production? Nothing touches production until a human engineer approves it. We take a backup before migrations when your plan supports it. On Supabase Free we give you a one-command dump to run, or skip schema changes until you upgrade. ### Is this a penetration test or a compliance certification? No. It's a fixed-scope fix for common critical issues in AI-built apps. It isn't a penetration test, a security guarantee or a compliance certification. ### Do you add features? No new features; we fix security issues and, with Fix & Deploy, get your existing app deployed. ### What does PatchAndShip fix? The security issues that AI app builders often leave behind: tables without Row Level Security, public storage of private files, secret keys in your app's code or repo, and secrets in public env variables. With Fix & Deploy we also point auth redirects at production and get the app live on your host with your domain and SSL. On Node/Express apps we also fix missing server-side access checks, open CORS and hard-coded secrets; these are fixed, but they are not "critical" for the 48-hour guarantee. ### Is the Supabase anon key safe to have in my app? Yes. The anon (publishable) key is designed to be public. The risk is what sits behind it: a table without Row Level Security, or a secret service_role key shipped in your app's code. Supabase says a secret key bypasses every Row Level Security policy and must never be in a browser. ### Why do apps built with Lovable or other AI tools leak data? Usually because Row Level Security was never switched on. The app works in preview either way, so nobody notices. In Sentris's scan of public GitHub repositories, 57% of Lovable repos had a table in the public schema with Row Level Security switched off, compared with 21.7% of Supabase repos with no AI-tool marker. Sentris may become a referral partner. ### Can you deploy my Lovable or Bolt app with my own domain? Yes, with Fix & Deploy ($249). We deploy your app to Vercel or Netlify, or keep a Lovable or Replit app on that platform's own hosting with your domain. For Bolt apps, Fix & Deploy deploys to Vercel or Netlify. We don't deploy to Bolt's own hosting. We set the env variables on the host, point the Supabase auth Site URL and redirect URLs at production, connect your custom domain with SSL and smoke test login, signup and your main flow. ### How much does it cost and how fast is it? Security Fix is $149 and Fix & Deploy is $249, one time, for one app. Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase. ## Why it matters (sources) - In Sentris's scan of public GitHub repositories, 57% of Lovable repos had a table in the public schema with Row Level Security switched off, compared with 21.7% of Supabase repos with no AI-tool marker. Sentris scanned 2,144 public repositories that use Supabase and found a confirmed critical exposure in 40.6% of them. Sentris may become a referral partner. https://sentris.dev/blog/we-scanned-2000-ai-built-supabase-apps - In Symbiotic Security's scan of 1,072 vibe-coded sites that use Supabase (Jun 2026), 172 let anyone delete database records without authentication, 172 allowed unauthenticated PATCH (modification), 39 had tables fully readable with the public Supabase key, and 14 allowed unauthenticated inserts. https://www.symbioticsec.ai/blog/we-scanned-1-072-vibe-coded-apps-98-had-security-flaws - Escape's research team analyzed more than 5,600 publicly available apps built on vibe-coding platforms (about 4,000 of them discovered on Lovable) and identified more than 2,000 vulnerabilities, 400+ exposed secrets and 175 instances of exposed PII (Oct 2025). Escape's report page says the findings were "across 1.4K vibe-coded applications". https://escape.tech/blog/methodology-how-we-discovered-vulnerabilities-apps-built-with-vibe-coding/ - CVE-2025-48757 (CVSS 3.1: 9.3, assigned by MITRE; disputed by Lovable) describes a Lovable RLS issue. https://nvd.nist.gov/vuln/detail/CVE-2025-48757 - A March 2025 scan reported 303 endpoints with inadequate RLS across 170 of 1,645 Lovable Launched projects. The researchers who reported it work at Replit, so it is not independent. https://mattpalmer.io/posts/statement-on-CVE-2025-48757/ - Supabase docs: a secret key bypasses every Row Level Security policy and must never be in a browser, a shipped application or source control. Publishable (anon) keys are designed to be public. https://supabase.com/docs/guides/api/api-keys ## Demo The website has a "Watch a fix" section: three short replays and screen recordings on a practice app with demo data, not a customer. https://patchandship.com/#demo ## Contact patchandship@gmail.com ## Links - Home: https://patchandship.com/ - Pricing: https://patchandship.com/#pricing - Free check: https://patchandship.com/#free-check - FAQ: https://patchandship.com/#faq - Short summary: https://patchandship.com/llms.txt - Refund policy: https://patchandship.com/refunds.html - Terms: https://patchandship.com/terms.html - Privacy: https://patchandship.com/privacy.html