shop.example
Sample
Grade
Sample Ship-Ready Score 45 out of 100, grade D. The service_role key is the critical finding.
- Public bundle read
- Database untouched
- service_role leakedCritical
Know before
you launch.
The free scan reads what a stranger can already download. Leaked keys, open files, missing headers.
The $29 test signs in as two users and asks whether one can read the other's rows.
Free. No account. We never query your database.
30 October 2026
New tables need a grant.Existing grants stay.
Supabase stops exposing new public tables to the Data API until someone adds a GRANT. Row Level Security does not change. GRANT ALL with no policy is the failure.
Changelog #45329Scan the URL.See the score.
Three steps. The prompt is written for the tool that built the app.
URL
shop.example
01
Paste a URL
We fetch the HTML and the scripts it loads.
45
Grade D
02
Read the score
Keys, files, headers, and a title that still says Vite App.
In Bolt, paste this…
Rotate the service_role key. Ship only the anon key.
03
Paste the fix
Lovable, Bolt, v0, Replit, Cursor, or a generic editor.
Then sign inas two users.
A writes a row. B tries to read it. That is the Live Test, not the free scan.
A
Writes a canary row.
customers
owner · note
A · launch canary
Blocked
B
Cannot read that row.
What a bad launchlooks like.
Four findings from the sample. Each one copies a fix prompt.
Critical
service_role key in the bundle
The browser already received the server key. We show eight characters. You rotate it.
High · Live Test
The other user can read the row
Not in the free scan. The $29 test signs in as two users and tries.
Medium
No Content-Security-Policy
The response ships without the headers that limit scripts, frames, and referrers.
Critical
/.env answered with secrets
A public path returned KEY=value. The report keeps the filename, not the values.
Free score.Pay for the proof.
The scan above is free. OCT30 is 30% off through 6 November, once checkout opens.
Fix Pack
$19
The write-up, plus five re-scans over 30 days.
Opens before 30 Oct
Live Test
The proof$29
Two test users. One tries to read the other's row.
Opens before 30 Oct
Launch Kit
$49
The live test, a launch checklist, and starter legal text.
Opens before 30 Oct
Monitoring
A weekly re-scan when the score drops. Pro adds a monthly two-account test. Coming soon.
$9–19/mo
Get a note when it opens.
Monitoring, or the paid scans. Not a newsletter.
We keep very little.
Secrets stay redacted
Type, an eight-character prefix, and a hash. The raw key is dropped.
Rows stay unread
The free scan never calls Supabase. It does not sign in.
Gone in 30 days
Write privacy@readytolaunch.cc to delete a waitlist address sooner. Privacy
FAQ
Totally fair to ask.
Paste a URL.
The free scan is the one that runs today.