“RLS is on” isn’t the same as safe.
A green shield can still hide a USING (true) policy that lets any visitor read every row. We check what your policies actually do.
We fix it. Tested. Explained.
Your AI built the app. We make it safe to launch.
Prodseal’s agents find the security holes Lovable, Bolt, Replit, and Cursor leave behind. Then they fix them, with tests, in a pull request you approve. About an hour, $49.
Free check. Only apps you own. Nothing changes without your approval.
Your keys may be in your JavaScript.
Service-role, Stripe, and OpenAI keys end up in client bundles. One leaked key can drain an API balance overnight.
Payments and logins break quietly.
Unverified Stripe webhooks, admin checks that only run in the browser, edge functions anyone can call.
How it works
1
Connect and verify.
Install our GitHub App or authorize Supabase (read-only). We only check apps you prove you own.
2
See your report.
Plain-English findings, ranked by severity, with evidence and what an attacker could do. Free.
3
Get the fix.
For $49, our agents write the fix and prove it with tests. Example: user B can’t read user A’s rows; anonymous visitors get nothing. You get a pull request, or a paste-ready kit if you’re on Lovable Cloud.
4
Merge and re-check.
You review and merge; we re-scan and confirm. Rotate any exposed keys with our step-by-step guide.
What we check
- Tables with Row Level Security off
- Policies that are on but wide open (USING (true), missing WITH CHECK, no owner scoping)
- Secret keys in your front-end bundle or git history
- Public storage buckets with user files
- API routes and edge functions anyone can call
- Admin or paid features protected only in the browser
- Stripe webhooks without signature verification
Pricing
Free check
$0
Full report of what we find.
Public surface, or a deep check after you prove ownership.
Fix bundle
$49
One-time, per app.
All Critical and High issues, as a tested pull request or paste kit. If the tests fail or the issue is still there after you merge, you get your $49 back.
Guardian
$29/mo
1 app.
Re-check on every push, auto-fix PRs, weekly report. Cancel anytime.
Guardian Pro
$99/mo
Up to 5 apps.
Everything in Guardian, for agencies and serial builders. Cancel anytime.
Run by AI agents, and we say so
Prodseal is operated by AI agents: scanning, fixing, testing, billing, and support. A human owner oversees money and legal matters. Every change is a pull request you approve. We never push to your main branch or touch your production keys.