For non-technical founders with an AI-built app

Your app is 80% done. Make the last 20% safe to take money.

  • Runnable RLS + 42501 SQL fixes
  • Stripe webhook test script
  • Leaked-key scanner
  • Not a PDF checklist

Scripts you run, not a checklist you read. Ship Kit finds open tables, leaked keys and Supabase's new "permission denied" (42501) errors, writes the exact SQL to fix each one, and fires real Stripe test events at your webhook. Guardrails and an undo button stop the "fix one thing, break two" loop.

Get Ship Kit · $27

One-time payment · 14-day money-back guarantee · No coding needed · Lovable, Cursor, Claude Code, Bolt, Windsurf

Not sure yet? Run the free 5-minute check first →

Watch it catch real problems

No made-up reviews. This is real, unedited output from the free check and Ship Kit run against our deliberately broken demo app. Pick a tool and press play.

$ node is-my-app-safe.mjs

Is My AI App Safe to Ship?  ·  free 5-minute check
Checking: ~/my-app

❌ FAIL  Secret keys are inside your website, where any visitor can copy them
    • Stripe LIVE secret key in src/lib/stripe.ts
    • Supabase service_role (admin) key in .env as VITE_SUPABASE_SERVICE_ROLE_KEY (that name makes it public)
    Anyone can open your site, view the source and use these keys. Move them to server-side secrets and replace them.

❌ FAIL  Your keys file (.env) is not protected
    • .env is already saved in your git history. Every key in it should be replaced.
    ✓ Done. .env is now listed in .gitignore.
    Still to do: run  git rm --cached .env  so git stops tracking it, then replace the keys in it.

❌ FAIL  Strangers can read your database
    • Readable by anyone with your public key: "profiles" (42 rows), "orders" (7 rows)
    Your public key is inside your website, so "anyone with the key" means anyone.

❌ FAIL  Your Stripe webhook doesn't check signatures
    • app/api/stripe/webhook/route.ts
    Anyone who finds the address can fake a "payment succeeded" message and get paid features for free.

⚠️  RISK  Nothing stops the "fix one thing, break two" doom loop
    • No rules file telling your AI to keep changes small.
    ✓ Created AGENTS.md. Cursor, Codex, Windsurf, Claude Code and most AI agents read it automatically, and so does Lovable once it is on your connected GitHub project.

Your score: 10/100  ·  Not safe to take real money yet

What this free check didn't look at:
  • Whether strangers can CHANGE or DELETE your data, not just read it
  • Public storage buckets (uploaded files anyone can download)
  • Fake sign-ups with emails people don't own
  • What happens to access on renewals, failed cards, cancellations, refunds and duplicate Stripe events
  • An undo button and full rules for Claude Code, Cursor, Lovable and Windsurf so one AI fix never breaks two features

The $27 Ship Kit checks all of that in one command, then gives you a copy-paste fix prompt for every problem.
Get it from the same page or email where you downloaded this file.
Real output from the free check and Ship Kit run against a deliberately broken demo app with fake keys. Folder paths and server addresses are shortened. Captured 2026-10-30.

Every problem comes with a fix you paste into your AI

Straight from the generated reports. Copy one into Lovable, Cursor or Claude Code and it knows exactly what to change, and what not to touch.


        
      

    

  







  

    
Sound familiar?

    
Real posts from founders on Reddit describing the problem. They aren't our customers, just people stuck where you might be.

    

      

        
"…then I'm in a doom loop, fix one thing, break two more."

        
r/lovable

      

      

        
"Anyone have a routine for this, or is it mostly ship and hope?"

        
r/nocode

      

      

        
"payment succeeds but app access doesn't update"

        
r/SaaS

      

    

  







  

    
Four tools. One command. Zero code to read.

    

      

        
Stops the doom loop

        
Guardrails for your AI

        
Rules that make Claude Code, Cursor, Windsurf and Lovable fix one thing at a time, ask before touching login or payments, and stop after two failed tries instead of piling on patches.

      

      

        
Stops the doom loop

        
An undo button

        
Save a restore point before every AI change. See what changed and whether it's too big. Go back in one command, and your current version is kept in case you change your mind.

      

      

        
"Is my app okay?"

        
Security scanner

        
Finds admin and payment keys visitors can copy, database tables strangers can read, new tables your app can't reach ("permission denied" since Supabase's Oct 30 change), public file storage and fake sign-ups. Every problem comes with a copy-paste fix.

      

      

        
"Does billing work?"

        
Billing tester

        
Sends your app realistic Stripe test events: purchase, renewal, failed card, cancellation, refund, duplicates and fakes. You find out what breaks before a real customer does.

      

    

  







  

    
Get Ship Kit

    

      

        

          
Ship Kit

          
Instant download · one-time payment

        

        
$27

      

      
    
        
  • Runnable SQL for Supabase: finds tables strangers can read and new tables that say "permission denied" (42501), then writes the exact grant + RLS fix for each
    • 
        
  • Stripe webhook test script: fires purchase, renewal, failed-card, cancel, refund, duplicate and fake events at your app
    • 
        
  • Leaked-key scanner with a copy-paste fix prompt for every problem
    • 
        
  • Guardrails for Claude Code, Cursor, Windsurf and Lovable, plus an undo button: save, check changes, undo
    • 
        
  • Plain-English START-HERE guide, set up in about 20 minutes
    • 
      


      

      Get Ship Kit · $27
      
Secure checkout by Polar. You'll get the download link by email straight away.

      
14-day money-back guarantee. If it doesn't help, email support@poofylabs.dev within 14 days for a full refund. No questions asked.

    

  







  

    
Free · 5 minutes

    
Is your AI app safe to ship?

    
5 checks, a score out of 100, and 2 problems fixed on the spot. It runs on your computer and never uploads your code.


    

      
📱 On your phone?

      
The free check runs on a computer. From your phone, you can:

      
    
        
  1. Do the 2-minute self-check right on this screen.
    2. 
        
  2. Send the laptop command and this page to yourself:
    3. 
      

      

        
        Email it to me
        
      

    


    Download the free check

    

      
Then: put the file in your app's main folder (the one with package.json), open a Terminal there, and run:

      
node is-my-app-safe.mjs

      
Prefer one line? Mac/Linux:

      
curl -fsSLO https://poofylabs.dev/downloads/is-my-app-safe.mjs && node is-my-app-safe.mjs

      
Windows (PowerShell):

      
iwr https://poofylabs.dev/downloads/is-my-app-safe.mjs -OutFile is-my-app-safe.mjs; node is-my-app-safe.mjs

      
Needs Node.js 18+ (free from nodejs.org). Using Cursor, Claude Code or Windsurf? Ask its chat: "Run node is-my-app-safe.mjs and explain the results in plain English."

    


    

      The 2-minute self-check (works on your phone)
      
Answer from memory, or open the Supabase and Stripe dashboards in your phone's browser. Every "yes" is a problem.

      
    
        
  1. In Supabase → Table Editor, does any table show RLS disabled or Unrestricted?
    2. 
        
  2. Has a table you made since Oct 30, 2026 shown "permission denied" (error 42501), or did your AI suggest grant all on all tables to fix it?
    3. 
        
  3. Is a service_role, sk_live_ or whsec_ key in your website's code, or in a setting starting with VITE_ or NEXT_PUBLIC_?
    4. 
        
  4. In Supabase → Storage, is a bucket holding user uploads marked Public?
    5. 
        
  5. In Stripe → Developers → Webhooks, is there no webhook, or are deliveries failing?
    6. 
        
  6. If your AI broke the app right now, would it take you more than a minute to get yesterday's version back?
    7. 
      

      
      
Ship Kit checks and fixes all six →

    

  







  

    
Next step · the deployment cliff

    
Preview-to-Production Blueprint

    
Most advice jumps from "connect GitHub" straight to "just Dockerize it". The Blueprint is the step-by-step middle: two runnable checks, copy-paste templates and a plain-English plan to move your app off the preview.

    
    
      
  • Pre-flight check before every deploy: build setup, pages that break on refresh, missing settings, staging sharing production's database, logins that redirect to localhost
    • 
      
  • Smoke test after every deploy: https, secret keys in the live code, a paused database, staging vs production
    • 
      
  • Real hosting and your own domain
    • 
      
  • Environment variables and secrets set up properly
    • 
      
  • Login redirects that work on the live site
    • 
      
  • A staging copy to test changes before customers see them
    • 
      
  • Backups and one-click rollbacks
    • 
      
  • Real setups with real monthly costs (from about $26/month), so you know what you'll pay
    • 
      
  • Copy-paste templates: env files, vercel.json, netlify.toml, Cloudflare rules, Supabase login settings, AI prompts
    • 
    

    
Instant download after checkout.

    Get the Blueprint · $197
    
14-day money-back guarantee. If it doesn't help, email support@poofylabs.dev within 14 days for a full refund. No questions asked.

    
Want both? Add it to Ship Kit with the box above the buy button.

  







  

    
Done with you · $2,500

    
"Finish the Last 20%" Pre-Launch Audit

    
An expert reviews your app, works through every problem with you asynchronously, and signs it off before launch: database rules, keys, billing edge cases and the bugs you've been looping on. Answer 3 quick questions to see if it's the right fit.


    

      

        1. Can people click through your app today, even if it's only a preview?
        
        
      

      
      
    


    
    
    

    

    
  







  

    
Questions

    
I can't code. Can I really use this?
Yes. You copy one folder into your app and paste commands from the guide. Every result is in plain English with a fix you paste into your AI. In Cursor, Claude Code or Windsurf you can even ask the AI to run the commands for you.

    
I build in Lovable or Bolt. Does it work?
Yes. Connect your project to GitHub, download a copy, and run the kit on it. Lovable reads the guardrails from AGENTS.md on GitHub-connected projects, or you can paste them into Project settings → Instructions.

    
Does it upload my code anywhere?
No. It reads files on your computer. It only contacts your own Supabase project (read-only, like a stranger would) and your own webhook (with test events).

    
Can it break my app?
The security scan only reads. The guardrails are text files. Undo always saves your current version first. The billing test sends fake test events to your webhook, which is its job, so use Stripe test mode.

    
How is this different from the free checklists on X?
A checklist tells you what to look for. Ship Kit actually looks: it runs the checks on your app, tests your billing with real Stripe-format events, and gives you the exact fix for each problem it finds.

    
What if it doesn't help my app?
Email support@poofylabs.dev within 14 days of buying and you get a full refund. No questions asked, and you don't have to prove anything.

    
How do I get it after paying?
Checkout emails you a download link straight away. Unzip it, copy the ship-kit folder (and blueprint, if you added it) into your app, and open START-HERE.md.

  






  

    
Stop shipping and hoping.

    
One command tells you what's wrong. One prompt per problem fixes it.

    Get Ship Kit · $27