Pre-launch inspectionhullcheck.dev
A pre-launch leak check for Supabase apps built with Lovable, Bolt, Cursor, Claude Code or Replit.
HullCheck finds the leaks AI app builders leave behind: database tables anyone can read, secret keys in your JavaScript, published source maps. Every finding comes with a fix prompt you can paste straight into Lovable, Cursor or Claude Code.
We only ever check domains you've proven you own. You verify with a DNS TXT record or a file under /.well-known/. No exceptions.
Why bother · someone else's research, not ours
Source: Reeve, “The State of Vibe-Coded App Security 2026”, published 19 August 2026: a passive scan of 30,998 live vibe-coded apps, 12–14 August 2026. Also summarised in VibeEval's August 2026 report. This is their research, not ours; HullCheck did not run this scan.
What you get back
Each finding says what's open, where, and what it means in plain English. Then comes a prompt you paste into your AI coding agent and, where you need it, the SQL for the policy.
We record pass or fail for each check. We never store the contents of your tables.
Deep check · specimenHullCheck
saltmarsh-tasks.example
profiles readable without login RLS disabled · 3 of 9 tables openservice_role key in /assets/index-4c1e.jsavatars not listableFix prompt · finding 1 · paste into your agent
Enable Row Level Security on public.profiles. Add a SELECT policy so a signed-in user can read only the row where id = auth.uid(). Don't change the app's queries.
What we check
Row Level Security switched off or misconfigured, so the public key in your app can read, or even change, your users, orders and messages.
Deep checkService-role keys, API tokens and webhook secrets that ended up in client-side JavaScript.
Free checkStorage buckets that anyone can list or read when they shouldn't be.
Deep checkYour own original source code, readable by anyone who opens the browser's developer tools.
Free checkMissing Content-Security-Policy, framing and transport headers.
Free checkHow it works
Add a one-line DNS record or a small file under /.well-known/. No verification, no check. That rule has no exceptions.
HullCheck looks at your live app the way an outsider would: what your public key can reach, and what your shipped files reveal.
Every finding comes with a prompt for your AI coding agent and, where you need it, the SQL for the policy.
Planned: run it from your agent. HullCheck will also ship as an MCP server, so Claude Code, Cursor and other agents can run a check before every deploy and fix what they find.
Pricing at launch
Early-access members get launch pricing. We'll ask before charging anything.
Secrets in your shipped JavaScript, published source maps, security headers.
FreeEverything in the surface check, plus the table and storage exposure test, fix prompts and policy SQL.
$19 one-timeA re-check after every deploy, an alert when something regresses, and MCP access for your agent.
$29 per monthFAQ
No. Every check requires proof that you control the exact domain. Probing someone else's app without permission can be illegal, and HullCheck won't do it.
Right now, only your early-access email and the optional answers you give. When checks launch, we'll record which checks passed or failed. We won't store the contents of your tables.
Supabase first, because that's where most AI-built apps keep their data. Firebase is next on the list.
No. HullCheck catches common, high-impact misconfigurations. If you handle payments, health data or anything similarly sensitive, get a professional review as well.
An independent developer in the EU who builds with the same AI tools you do. Questions go to hello@hullcheck.dev.
Early accesshullcheck.dev
Join early access and we'll email you once, when HullCheck is ready.
Two optional questions help us build the right thing first.
What do you build with?
Want a $19 deep check reserved at launch?
No payment now. We'll hold launch pricing for you and ask before charging anything.