ShipSafe
A 60-second security scanner for vibe-coded apps — paste a URL, find exposed API keys and publicly-readable database tables before someone else does.
Project Gallery
Designer & AI Developer
2 weeks
Overview
ShipSafe scans a deployed app for the two mistakes that leak user data: live API keys shipped in the JS bundle, and Supabase tables left readable by anyone on the internet. Paste a URL, get a severity report and copy-paste fixes in about a minute. I designed and built the whole thing.
Challenge
Security tools are either enterprise-dense or useless. The challenge was making a real scan — bundle parsing, credential detection, RLS probing — feel approachable to an indie dev who just shipped something and isn't sure it's safe.
Approach
I designed a single-input, terminal-flavored flow that reads like a report, not a dashboard. Server-side it fetches the target's bundles and regex-scans for live secrets — every value redacted before it ever leaves the server — then probes Supabase tables with the public anon key, the same way a real leak gets found. The output is plain: severity, what's exposed, and the exact SQL to lock it down.
Outcome
Live, and hardened past an 18-finding adversarial security review of its own design. A build-in-public proof that I design and ship working tools, not just mockups.