Within 48 hours of working access or a full refund. This guarantee is for Security Fix ($149) and Fix & Deploy ($249). The $49 Database Check has its own: your report within 24 hours of working access.

Plans

PatchAndShip plans (USD, one app per order)
Plan	Price	What's included	Turnaround
Database Check	$49, one time	Read-only review of Row Level Security and policies, anon and authenticated grants, storage buckets, Security Advisor (or Lovable security scan) findings and where a service_role or secret key appears; red, yellow and green report. We change nothing.	Report within 24 hours of working access
Security Fix	$149, one time	RLS fixes on all tables; storage bucket policies; key scan and rotation guidance; short report.	Within 48 hours of working access
Fix & Deploy	$249, one time	Everything in Security Fix, plus production deploy; env vars and auth redirects; custom domain and SSL; smoke test of key flows.	Fixed and live within 48 hours of working access
Launch Pack add‑on	$149 once, or $99 a month	Launch posts, SEO copy and a directory list.	Not covered by the 48‑hour guarantee

The guarantee

Security Fix: every critical issue on our checklist fixed within 48 hours of working access. For an exposed secret key, 'fixed' means we've removed it from your code in the change we deliver. Redeploying your app, setting the key on your host and rotating the key are steps you take, and we give you exact instructions or tell you exactly which host setting to change. Older copies of the key can remain in your repository's history; rotating the key makes them useless, and rewriting history is a separate request. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase.

The 48 hours count from when we receive working access to your app. The clock pauses while we are waiting on you.
“Critical” means only the issues on our published checklist: Row Level Security (RLS) disabled or misconfigured, public storage buckets holding private files, exposed secret keys (in the client bundle, repo or public env variables), and, on Fix & Deploy only, misconfigured environment variables or auth redirects.
“Live” (Fix & Deploy only) means deployed on the host you choose. If you use a custom domain, its DNS settings depend on you.
Email patchandship@gmail.com within 14 days of your purchase to request a refund under the guarantee. Approved refunds are processed within 5 business days.
If you don't provide working access within 30 days of your purchase, you get a full refund.
Database Check: your report within 24 hours of receiving working access (the complete results of our read-only script and your security findings), or a full refund if you ask within 14 days of your purchase. A person reviews and approves every report. Want the fixes after? Buy one for the same app within 14 days and your $49 counts toward it, so you pay $100 or $200. Use the upgrade link or the one-time code we email you. Already paid full price in that window? Ask us and we refund the $49.
The Launch Pack, one-time or monthly, is not covered by the 48-hour guarantee.
Monthly plan: not covered by the 48-hour guarantee. You can cancel anytime by emailing patchandship@gmail.com. Cancellation takes effect at the end of the current billing period, and we do not give partial refunds.

Full terms: Refund Policy.

What one order covers

The Fix & Deploy package ($249) deploys one app to Vercel or Netlify, or keeps a Lovable or Replit app on that platform's own hosting with your domain. Each order covers one app, one Supabase project (or one Node app) and one deploy target. No new features. Not a penetration test or compliance certification. Custom backends and VPS/Docker setups are quoted separately.

Apps with more than 25 user‑defined tables are declined or quoted separately. More than one Supabase project needs separate orders.

Each Database Check covers one app and one Supabase project (or one Lovable Cloud backend). If your app has more than 25 user‑defined tables, we quote you a price before we start, and if you decline, you get a full refund.

Free checks

PatchAndShip's free emailed mini check is passive: it looks only at the public homepage, its scripts and its security headers, and nothing else. It flags exposed secret keys, missing headers and public storage links found in the code (the bucket itself is never opened or listed). No database queries, no logins, no changes. It returns a one‑page summary within 24 hours. The app owner (or an authorized person) must consent. Ask at patchandship@gmail.com or use the emailed mini check button.

PatchAndShip also runs a free instant check at patchandship.com/check.html. Paste a URL and it loads the homepage, up to 10 of its own JavaScript files, and its security headers, then shows the result on screen in a few seconds. No signup. It doesn't log in, query databases, request unlinked paths, or change anything.

How to order

Secure checkout by Stripe. After you pay for the Database Check, Security Fix or Fix & Deploy, Stripe takes you straight to the intake form. We also email you the link. After you buy the Launch Pack, we email you within 2 hours (8 AM to 8 PM PT; otherwise by 10 AM PT) to get it started.