Seaworthy
Is your AI-built app safe to launch?
Cursor, Claude Code, Lovable and Bolt write working code fast. They also skip authorisation, leak keys into the browser and leave database tables open to anyone with your public key. Seaworthy finds those gaps on your own machine, before your users do.
How it works
One command. Nothing uploaded.
Seaworthy reads your project where it sits, works out your stack, and runs only the checks that apply. Each finding comes with the file and line, what an attacker could do, how to fix it, and a prompt you can paste into your AI coding tool. Secrets are masked in every report.
- Runs locally: your code, findings and file names never leave your machine
- Exit codes for CI, plus terminal and JSON output
- Ignore a finding with a comment, but only with a written reason
- Works with your AI assistant: a local MCP server, and a "check before deploying" step for its rules file
HIGH Policy on public.notes lets anyone read every row SW-D02 supabase/migrations/0001_init.sql:18 17 │ create policy "Notes are readable" > 18 │ for select using (true); Why Anyone with your public anon key can read every user's notes. Fix using ((select auth.uid()) = user_id)
What it checks
The gaps that sink AI-built apps.
Checks written for Next.js, React, Vue, Svelte, Supabase, Firebase, Stripe and the major LLM SDKs. Each one is tuned for few false alarms: it looks at what your code actually does, not just at words in it.
Secrets
- API keys and passwords committed to the repo, now or in its git history
.envfiles committed or not git-ignored- Secrets given a public prefix, so they ship to the browser
- LLM keys used in browser code
Database and storage
- Supabase tables with no row-level security
- Policies that let everyone in (
using (true)) - Public Supabase buckets holding private files
- Open Firestore, Realtime Database and Storage rules, including forgotten test mode
API routes and payments
- Routes and server actions with no auth check
- Records fetched by ID without checking the owner
- No rate limit on AI, email, SMS or login endpoints
- CORS that lets any site make credentialed requests
- SQL built from user input
- Stripe webhooks that don't check the signature, and prices taken from the client
AI, agents and dependencies
- User input pasted into the system prompt
- Model output rendered as HTML or run as code
- Agent tools with shell or file access and no guard
- MCP configs with plain-text secrets or open servers
- Dependencies with known vulnerabilities, from OSV
- Packages that don't exist on npm (often invented by AI tools) or are brand new
- Missing security headers
Plans
Free does the real work.
Every check is free, forever. Paid plans add pull-request checks, scheduled alerts, reports, history and agency features. A paid feature never blocks a scan: without a plan, Seaworthy still runs and tells you which plan adds it.
Free
- Every check
- Terminal, JSON, SARIF and Markdown output, exit codes for CI
- A GitHub Actions workflow in one command
- Fix text and paste-ready AI prompts
Pro For solo builders
or £12 a month
- Everything in Free
- Pull-request checks: one comment with only the problems a change introduces
- Weekly scans with Slack, webhook or email alerts when something new appears
- Self-contained HTML report to share with clients or investors
- Scan history and trends
- Before/after comparison, and "since last scan" on every run
- Priority support
- 2 machines per licence key
Agency
- Everything in Pro
- White-label reports: your logo, agency name and client name
- Scan every project in a folder, one combined report
- 10 machines per licence key
After you buy: get your key from the customer portal (enter the email you bought with), then run npx seaworthy-cli login <key>. In CI, add it as a secret called SEAWORTHY_LICENCE. From the terminal, npx seaworthy-cli buy opens the checkout.
Checkout is handled by Polar, our merchant of record, which also handles sales tax and VAT, invoices and your subscription. Cancel any time; see refunds. Coming to Pro: fix pull requests for mechanical fixes.
Questions
The fine print, in plain English.
Does my code leave my machine?
No. Seaworthy reads your files locally. The dependency checks send package names and versions to osv.dev, and package names to the npm registry; --offline skips both. With a paid plan, it also sends your licence key, a machine name and IDs from the licence server, at most once a day. Never code, findings or file names.
Does it work offline and in CI?
Yes. A confirmed licence keeps working for 14 days offline. In CI, set SEAWORTHY_LICENCE to your key; it doesn't use up a machine.
Is it a security audit?
No. It is an automated check that catches common, serious mistakes. It is not a certification or a guarantee, and no tool finds everything.