Collection by @slashclone · updated 7 Nov 2026

Stop leaks before you launch

Keys in git, data other users can see, fake payments, risky packages, and trackers that load before consent: the kits that catch them before your users do.

@shipcheckSkill
Check your app for leaked API keys and secrets by @shipcheck
Check whether you leaked API keys or secrets before you push, open-source, or launch your app. Finds .env files git tracks or kept in history, server keys exposed to the browser through NEXT_PUBLIC_ or VITE_, Stripe, AWS, OpenAI, Anthropic, and Supabase key shapes, and hardcoded passwords, then walks you through fixing and rotating them. Reports names and redacted hints, never the values.
- Anthropic
- OpenAI
- AWS
- Supabase
- Stripe
- +1 more: GitHub
Likes:0Installs:0
Leaked API keys and secrets in your repo.
@shipcheckSkill
Stop users seeing each other's data in Supabase by @shipcheck
Check that strangers and other users cannot read or change your data in Supabase before you launch. Replays your migrations to find tables with row level security off, policies that let anyone write or trust user_metadata, views that skip RLS, and risky SECURITY DEFINER functions, then drafts a fix migration for you to review. Reads .sql files only; never touches your database.
- Supabase
Likes:0Installs:0
Supabase tables other users can read or change.
@shipcheckSkill
Secure your Stripe webhook against fake payments by @shipcheck
Make sure nobody can fake a payment or get double credit through your Stripe webhook. Finds your handlers and checks signature verification, raw body, signing secret in env, once-only processing, 400 on bad signatures, and that access comes from the webhook, not the success page, then proposes diffs. Reads your code only; never calls Stripe.
- Stripe
- Supabase
Likes:0Installs:0
Fake payments and double credit through your webhook.
@slashcloneSkill
Security audit for your web app before launch by @slashclone
Get a written security audit of your web app before launch or after a big feature. Covers the API, sign-in and OAuth, MCP connectors or CLIs, and file uploads, and writes a threat model plus numbered findings with severity, fix, and how each fix was verified. Reads the code and runs signed-out checks only; never changes your code.
Likes:0Installs:0
A written security review of the whole app.
@slashcloneSkill
Install npm packages safely by @slashclone
Install and upgrade npm packages safely, so your agent never pulls a typosquat or a freshly compromised release. Before adding a package it confirms the exact name, the latest stable version, and that the version is at least 14 days old, then pins it exactly and commits the lockfile. Also pins CI actions and container images by SHA or digest.
- npm
Likes:0Installs:0
Typosquats and freshly compromised packages.
@slashcloneSkill
Add a cookie consent banner to your website by @slashclone
Add a cookie consent banner to your website where analytics, ad pixels, and video embeds load only after a yes, and rejecting is one click. One registry of every cookie and service drives the banner, the script loaders, the Content Security Policy, and the cookie table on your privacy page, with a registry checker and React templates. Engineering guidance, not legal advice.
Likes:0Installs:0
Analytics and pixels that load before a yes.
@slashcloneSkill
Embed YouTube videos without tracking cookies by @slashclone
Embed YouTube videos on your site without loading anything from Google until the visitor presses Play or allows videos. A click-to-play placeholder with a local poster swaps in the youtube-nocookie.com player, with a keyboard-friendly button, no layout shift, CSP entries, and a Playwright test that proves no YouTube request happens first. React and HTML templates. Not legal advice.
- YouTube
- Playwright
Likes:0Installs:0
Video embeds that track visitors before they press Play.

Check your app for leaked API keys and secrets by @shipcheck

Stop users seeing each other's data in Supabase by @shipcheck

Secure your Stripe webhook against fake payments by @shipcheck

Security audit for your web app before launch by @slashclone

Install npm packages safely by @slashclone

Add a cookie consent banner to your website by @slashclone

Embed YouTube videos without tracking cookies by @slashclone