Who can secure my Bolt app?

What does PatchAndShip fix in a Bolt app?

The critical issues covered by the 48‑hour guarantee, for Bolt apps on Supabase:

• Row Level Security disabled or wide open on your tables.
• Storage buckets that make private files public.
• Secret keys in the frontend bundle or the repo.
• Secrets under public env prefixes, for example VITE_*.
• SECURITY DEFINER views or functions that leak private data.
• Auth Site URL or redirect settings that are wrong for production.

The full list is in our Refund Policy and Terms.

What access does PatchAndShip need?

Least-privilege access only: collaborator access on your GitHub repo, a Supabase org invite with the lowest role your plan allows, and for Vercel a guided handoff or a scoped, expiring token. We never ask for passwords, tokens are shared only via a one-time link, and at handoff you revoke our access (we send a checklist).

For Bolt, invite us to your project as an Editor from Share; remove us from the same menu when we're done. On a Teams plan, an admin needs to turn on external collaboration first.

For Vercel, you don't need to buy a seat or invite us to your team: we give you a deploy-ready repo and an env-var checklist, then either walk you through a short guided handoff with the exact clicks, or use a scoped, expiring Vercel access token you share through a one-time link, never your password.

For Netlify, you don't need to add us to your team: we give you a deploy-ready repo and an env-var checklist and walk you through a short guided handoff with the exact clicks, never your password.

What does it cost, and what if it isn't done in 48 hours?

Two fixed prices per app, paid once:

Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase. The 48 hours start when PatchAndShip gets working access, and the clock pauses while we're waiting on you, for example on DNS.

Per order: one app, one Supabase project, one deploy target. Apps with more than 25 user-defined tables are declined or quoted separately. No new features. Not a penetration test or compliance certification.

Can I start with a free check?

Yes. PatchAndShip's free mini check is passive: it looks only at the public homepage, its scripts and its security headers (for exposed secret keys, missing headers and publicly listed storage links), and nothing else: no database queries, no logins, no changes. It returns a one‑page summary within 24 hours. It's for app owners, or someone the owner has authorized.

Request the free check

Can I fix it myself instead?

Yes. Start with our step-by-step guide, How do I fix Supabase RLS in a Lovable app? The same steps work for any app on Supabase. Then work through the free Supabase RLS checklist. Deploying too? See How do I deploy a Bolt app to a custom domain?

Where do these facts come from?

1. PatchAndShip service details: pricing, Refund Policy, Terms. This page has no third-party statistics.

All sources checked on 2026-10-14. PatchAndShip's own guidance and service details are labeled as ours.