Original Summary

Hi all, I've been building Shippable , a free security check for apps made with Lovable, Bolt, v0, Cursor and similar tools. Why: AI builders ship fast, but they often leave the database open (Supabase tables anyone can read with the public key), put secret keys in the browser, or create backend functions that never check who's calling. Most "security scanners" I tried just grade your HTTP headers. How I'm testing it (the part I'm proudest of): I had small apps built the way AI tools build them, each with ~25 planted security holes plus a few decoys that look risky but aren't. The answer key was sealed (hashed) before any tool ran. Then I ran my scanner and several others on the same app, the same day. Results so far: Reading the project's code (CLI + your AI agent via MCP): 25/25 holes found, 0 decoys flagged CLI alone, no AI agent: 18/25 . The other 7 were logic bugs (a free-plan limit only enforced in the browser, a gift code you can redeem twice, a refund you can trigger repeatedly). Those need something to read the code. Things I learned: The scariest bugs in AI-built apps are logic, not config: "users can set their own plan to Pro", "anyone can call the email function with any recipient". You need to read the code to find those. Hosting providers' bot protection (Vercel especially) will block a scanner after a few requests. I had to make the site wait and retry gracefully instead of failing. Being honest about misses helped more than chasing a big number. Every miss became a general fix, never a special case for the test app. How it works: you prove you own the app with a one-line tag (so nobody can scan apps they don't own). It's read-only, and every finding comes with proof plus a fix prompt you paste into your AI tool. There's also a "copy all fixes" button for one big prompt. It's free: shippable.dev . Or run npx shippable-dev scan localhost:5173 in your project. What I'd love feedback on: Does it flag anything on your app that's wrong? There's a "This looks wrong?" button on every finding, and I read every one. Which builder/host are you on? I've tested Vercel the most and want to cover lovable.app , Netlify and Bolt hosting next. Happy to answer anything about the testing setup.   submitted by   /u/R_Egarter [link]   [comments]

  • 情报分类：服务器与云资源
  • 分类依据：内容涉及服务器、云资源或网络线路
  • 信息来源：Reddit · SaaS
  • 发布时间：2026/10/7 00:12:19