Quickstart

After you sign in, setup has six steps. The app shows them in a rail on the left and brings you back to the first unfinished one each time you sign in.

1. Sign in

Go to app.stableship.ai and choose Continue with GitHub. Signing in and signing up are the same step. GitHub sign-in shares only your profile and email address; it gives Stableship no access to your code. You can also sign in with an email link. See Signing in.

2. Install the GitHub App

Install the Stableship GitHub App and choose which repositories it can read. Stableship reads your code to draft your rules and build the private copy, and posts a check on each push. It never pushes, opens pull requests or merges. See Connecting GitHub.

3. Pick the app

Choose the repository where your customers' flows live, plus any others that ship with it. If you pick more than one, say which one has the app's pages. You can also add the address of the live site, so tests never reach it.

Picked the wrong repository or database? Choose App or Database in the setup steps, or Change next to it before you start the audit. Your app is changed in place, never set up twice.

4. Connect your database

Choose Connect Supabase and approve read-only access to your project's structure, then pick the project behind your app. Stableship reads tables, roles, policies and functions. It never reads your customers' rows and never writes to your live project.

Does your builder run Supabase for you (Lovable Cloud, Bolt)? Choose Build from my migrations and the copy is built from the migrations in your repository. Stableship tests Supabase apps only for now; on another database, tell us your stack and we email you when we support it. See Connecting Supabase.

5. Confirm who should see what

Stableship reads your app, which takes a few minutes, and drafts the kinds of user it found (for example a customer, a teammate and a guest) and the rules for who may see and change what. You confirm them in plain words.

Then, if there is anything to hand over, Test setup asks for it one item at a time: a Stripe test key so checkout is tested end to end, a test key for each AI service your app calls (capped at $5 an audit), the settings tables to copy and the rows your code looks for. Skip any of them and the audit says it was not tested.

The rules are what Stableship tests against, so a minute here pays off. You can change them any time under Access (who can see what) and Flows (what every check clicks through).

6. Connect your coding agent

This step is optional, and you can come back to it from Settings, then Connections. Pick your tool and follow the steps the app shows. Most tools add the Stableship MCP server (https://api.stableship.ai/mcp) and sign in through your browser, with no token to copy. Once connected, your agent can read what Stableship found, fix it and ask Stableship to check the fix.

7. Start the audit

Add the app to a plan (Essentials is the lowest way in; see Plans and pricing) and the audit starts right away. It runs for up to an hour on most apps, and up to 90 minutes on the largest. You can close the tab: you get an email when it is done.

What you get

• A report you can share, with a verdict, every step that was tested, and what was not tested and why.
• A video of every reproduced problem.
• A fix plan for your coding agent, STABLESHIP_FIXES.md. Choose Send to my agent on the release to hand it over.
• A re-check: push your fixes and Stableship tests every open problem again on a fresh copy.

After the first audit

Every push and pull request is checked from then on, at a scope that fits what changed. On Protect, a release that breaks one of your rules is held until it is fixed or someone ships it anyway. Read How Stableship works for how checks, findings and verdicts fit together.