SIGSHIPGuides
Launch your AI-built app without the scary surprises.
Short, plain-English guides for builders who aren't security experts. No jargon without an explanation.
Vibe coding security checklist
A plain-English checklist for apps built with Lovable, Bolt, Cursor, Replit or v0: the ten mistakes AI tools leave behind most, and how to fix each one.
Read the guide → GuideCheck a Lovable, Bolt, Replit or v0 app
Step by step: get the code of your Lovable, Bolt, Replit or v0 app onto your computer and check it for leaked keys, open databases and other launch blockers, free.
Read the guide → GuideSupabase RLS, explained simply
What Supabase row level security is, why AI-built apps often ship without it, and how to turn it on and write a basic policy, in plain English.
Read the guide → GuideLeaked an API key? What to do now
You pushed an OpenAI, Stripe or other API key to GitHub or your website. Here is exactly what to do, in order, to stop the damage and keep it from happening again.
Read the guide → GlossaryJargon, explained
API keys, RLS, webhooks, CORS, MCP and more, each in one or two plain sentences.
Open the glossary →Check your app before your users do.
Free, open source, and nothing leaves your computer.
$ npx sigship