The free audit
Connect GitHub and Supabase, confirm who should see what, and Stableship tests a private copy of your app as every kind of user. No card. Up to an hour.
One free audit per GitHub account.
Sign in with GitHub and install the Stableship app on the repos you pick. It posts a check on each push and never pushes to your branches.
Approve read-only access and pick your live project. We read its structure, never a row of your data.
Optional notes, plus what your CLAUDE.md, AGENTS.md and Cursor rules already say.
We draft the rules from your code and database. You answer a few plain questions.
Up to an hour. Close the tab; we email you when it is done.
What you connect
Read-only where it can be, and never your customers' data.
What runs
Each step is in your report, with what passed, what did not, and a video of every session.
Code reviewed against your rules · RLS on every table, keys, security-definer functions, Edge Function JWT checks, dependencies
Private Supabase copy built · Your migrations, auth settings and Edge Functions on a temporary project
Test users and data created · An account for each kind of user, plus another customer to try to reach
Isolation confirmed · The copy talks to the test database, never production
Used as every kind of user · Signup, checkout and your critical flows, with a video of each
Tried to break your rules
Each user tried to open another customer's records, in the app and by address
Phone-size pass and accessibility
Critical flows on a phone screen, plus accessibility checks on every page
Supabase advisors · Supabase’s own security and performance checks, run on the copy
Every failure replayed · On a fresh copy, twice. Only reproduced problems block
The private copy is a temporary Supabase project in our own organization. It is built from the migrations in your repo, gets your auth settings and Edge Functions with test secrets, and is seeded with an account for each kind of user, plus another customer whose records they should never reach.
Agents use the app the way your customers do. A second agent replays every failure on a fresh copy, twice. Only problems that reproduce can block a release; everything else is a note.
When the run ends, the copy and the sandbox are deleted.
What you get
Everything is written so a founder can read it and a coding agent can act on it.
A verdict, every step and whether it passed, problems ranked by who they affect and the rule they break, and what was not tested and why. Private until you share the link.
Every problem as an ordered task for your coding agent, blocking ones first, each with where to look, steps to reproduce and when it is done. Download it, copy it as one prompt, or have it opened as a pull request.
Push your fixes and Stableship re-tests every open problem on a fresh copy. The report updates: fixed, or came back.
Signed in as a regular member of Beta Co, we changed the invoice number in the address bar to one belonging to Acme Ltd. The page loaded with Acme's name, amount and card ending 4421.
# Stableship fix plan for acme-app Updated 2026-10-14. 3 tasks: 1 blocking, 1 proven, 1 quick win. ## Blocking: fix these before you launch ### 1. A member of one company opened another company's invoice. Blocks the release · Critical · Reproduced · found as member **Rule it breaks:** An invoice can be opened by the company itbelongs to and its admins. Everyone else gets "not found". **Where:**- public.invoices (row level security)- src/pages/invoices/[id].tsx **Done when:**- [ ] A member of Beta Co gets "not found" for invoice 1017- [ ] Acme Ltd members can still open their own invoices **Verify:** `stableship verify f_8k2q`The fine print
On another stack? Tell us what you use and we will email you when we test it.
After the audit
Protect checks every release and pull request, holds unsafe releases, runs 2 full audits a month and opens fix pull requests for you to approve. Your coding agent can work through it all.