Your AI Shipped the App. Did It Leave the Keys in the Repo?

Description and use

vibe-shipcheck is a CLI that checks AI‑generated Supabase apps for configuration errors like disabled RLS and committed .env files, providing fixes before deployment.

Problem

AI coding tools generate SQL migrations that leave row‑level security (RLS) disabled, exposing personal data in Supabase databases.

Outcome

vibe-shipcheck identifies and fixes configuration gaps that AI-generated apps commonly miss, preventing accidental data exposure before deployment.

Workflow

• Install vibe-shipcheck via pip
• Run vibe-shipcheck against the project directory
• Review errors and warnings reported
• Apply suggested fixes (e.g., add ALTER TABLE ... ENABLE ROW LEVEL SECURITY, remove .env from git, restrict CORS origins)
• Re‑run vibe-shipcheck to confirm no errors
• Proceed to CI or deployment

Evidence

AI coding tools write SQL migrations directly, and in that path Postgres row-level security defaults to off.

Source

vibe-shipcheck 0.1.0 — pre-publish security check Scanning: /home/hao/my-app ERRORS: [env-committed] .env — .env file is tracked by git — its secrets ship with the repo fix: Add it to .gitignore, run git rm --cached .env, rotate every key it held.

Source

[rls-disabled] supabase/migrations/001_init.sql — migration creates table(s) profiles without ENABLE ROW LEVEL SECURITY — readable by anyone with the anon key fix: Add ALTER TABLE <table> ENABLE ROW LEVEL SECURITY; plus policies for every table, or enable RLS in the dashboard.

Source