Collection by @shipcheck · updated 7 Nov 2026

Launch your first app safely

Go from it works on my machine to safe in production: a launch checklist for your stack, no leaked secrets, locked-down database access, hardened payments, and a fast fix when a deploy fails.

@shipcheckSkill
Pre-launch checklist for your first app by @shipcheck
Find out what your app still needs before real users arrive, built from your actual code. Detects your stack (Supabase, Firebase, Stripe, Next.js, auth, email) and writes a checklist of blockers, first-week items, and later, each marked verified, failing, or a question for you. Covers data access, payments, secrets, auth, rate limits, monitoring, backups, email, legal pages, and SEO.
Likes:0Installs:0
Start here: a pre-launch checklist that reads your project and stack.
@shipcheckSkill
Check your app for leaked API keys and secrets by @shipcheck
Check whether you leaked API keys or secrets before you push, open-source, or launch your app. Finds .env files git tracks or kept in history, server keys exposed to the browser through NEXT_PUBLIC_ or VITE_, Stripe, AWS, OpenAI, Anthropic, and Supabase key shapes, and hardcoded passwords, then walks you through fixing and rotating them. Reports names and redacted hints, never the values.
- Anthropic
- OpenAI
- AWS
- Supabase
- Stripe
- +1 more: GitHub
Likes:0Installs:0
Before you push: make sure no secrets are in git or about to be.
@shipcheckSkill
Stop users seeing each other's data in Supabase by @shipcheck
Check that strangers and other users cannot read or change your data in Supabase before you launch. Replays your migrations to find tables with row level security off, policies that let anyone write or trust user_metadata, views that skip RLS, and risky SECURITY DEFINER functions, then drafts a fix migration for you to review. Reads .sql files only; never touches your database.
- Supabase
Likes:0Installs:0
If you use Supabase: find tables anyone could read or write.
@shipcheckSkill
Secure your Stripe webhook against fake payments by @shipcheck
Make sure nobody can fake a payment or get double credit through your Stripe webhook. Finds your handlers and checks signature verification, raw body, signing secret in env, once-only processing, 400 on bad signatures, and that access comes from the webhook, not the success page, then proposes diffs. Reads your code only; never calls Stripe.
- Stripe
- Supabase
Likes:0Installs:0
If you take payments: verify and harden your Stripe webhooks.
@shipcheckSkill
Fix a failed Vercel or Netlify deploy by @shipcheck
Fix a deploy that works locally but fails on Vercel or Netlify: paste the build log, get the likely cause and the fix. Finds the first real error and matches about twenty common failures, like letter-case imports, missing packages or env vars, window is not defined, lockfile drift, wrong Node version, and out of memory. Checks your code and asks before changing anything.
Likes:0Installs:0
When a deploy fails: paste the build log and get the likely fix.

Pre-launch checklist for your first app by @shipcheck

Check your app for leaked API keys and secrets by @shipcheck

Stop users seeing each other's data in Supabase by @shipcheck

Secure your Stripe webhook against fake payments by @shipcheck

Fix a failed Vercel or Netlify deploy by @shipcheck