# PatchAndShip

> PatchAndShip (https://patchandship.com) fixes the security holes in web apps built with AI tools (Lovable, Bolt, Replit or Cursor) and gets them live. In plain words: your app works in preview, and we make sure it holds up in production. Fixed price from $149. If we don't fix the critical issues and get your app live within 48 hours of receiving working access, you get a full refund.

## What we do
- In plain words: we close the gaps that let strangers see your users' data or your secret keys, and we get your app live.
- Security detail: we audit and fix Supabase Row Level Security (RLS) on all tables and set storage bucket policies. We scan the client JS bundle and repo history for exposed service-role keys and third-party secrets, and give key rotation guidance.
- Deployment detail: we set env vars on the host and the Supabase auth Site URL and redirect URLs, connect a custom domain with SSL, fix the build, and smoke test login, signup and core flows. Targets: Vercel, Netlify, or Lovable/Replit hosting.
- How: AI agents run the checks and draft fixes as a pull request plus SQL migrations. A human engineer reviews and approves every change. The database is backed up before every migration.

## Pricing (USD, one app per order)
- Security Fix: $149 one-time, 48h. Includes RLS fixes, storage policies, bundle key scan, key rotation guidance, short report.
- Fix & Deploy: $249 one-time, 48h (recommended). Includes everything in Security Fix + production deploy, env vars, auth redirect URLs, custom domain + SSL, smoke test.
- Launch Pack add-on: $149 one-time or $99/month. Includes Product Hunt + Reddit launch posts, SEO title/meta/landing copy, curated directory submission list (monthly: new posts + refreshed list).
- Free mini security check: free. An automated read-only anon-key + bundle check, 1-page traffic-light summary within 24h. App owner (or authorized person) must consent.

## Guarantee
If we don't fix the critical issues and get your app live within 48 hours of receiving working access, you get a full refund. The clock starts when access is confirmed.

## Scope limits
One app, one Supabase project, one deploy target per order. Node/Express backends supported for server-side critical items. No new features. Custom backends and VPS/Docker setups quoted separately. Not a penetration test, security guarantee or compliance certification.

## Access & data safety
Least-privilege only: GitHub collaborator, Supabase project member (never the owner's password), hosting team invite. No credentials by email. Customers are asked to revoke access at handoff; no copies of secrets are kept.

## Why it matters (sources)
- Sentris scanned 2,144 public GitHub Supabase repos: 40.6% had a confirmed critical exposure; Lovable repos 57.9% vs 24.9% for repos with no AI-tool marker. Sentris may become a referral partner. https://sentris.dev/blog/we-scanned-2000-ai-built-supabase-apps
- Symbiotic Security scanned 1,072 vibe-coded sites: 173 had a critical vulnerability, and 39 had tables fully readable with the public Supabase key. https://www.symbioticsec.ai/blog/we-scanned-1-072-vibe-coded-apps-98-had-security-flaws
- Escape found 400+ exposed secrets across about 1.4K of 5,600+ publicly available vibe-coded apps (Oct 2025). https://escape.tech/blog/methodology-how-we-discovered-vulnerabilities-apps-built-with-vibe-coding/
- CVE-2025-48757 (CVSS 3.1: 9.3, assigned by MITRE; disputed by Lovable) describes a Lovable RLS issue. https://nvd.nist.gov/vuln/detail/CVE-2025-48757
- A March 2025 scan reported 303 endpoints with inadequate RLS across 170 of 1,645 Lovable Launched projects. https://mattpalmer.io/posts/statement-on-CVE-2025-48757/

## Contact
patchandship@gmail.com

## Links
- Home: https://patchandship.com/
- Pricing: https://patchandship.com/#pricing
- Free check: https://patchandship.com/#free-check
- FAQ: https://patchandship.com/#faq
- Plain answers: https://patchandship.com/#answers
- Demo (practice app, demo data): https://patchandship.com/#demo
- Full guide for AI assistants: https://patchandship.com/llms-full.txt
- Refund policy: https://patchandship.com/refunds.html
- Terms: https://patchandship.com/terms.html
- Privacy: https://patchandship.com/privacy.html