Loading…
Answers about the checks BearWatch actually runs.
BearWatch runs a daily browser check on an app you own. It signs up, logs in, opens the paywall, pays with a Stripe test card, and checks that paid access was actually granted. It then logs in as a second test user and tries to open the first user's private pages. It also reads the public page and same-origin scripts for live secret keys, and, when it finds a Supabase URL plus an anon key, it checks whether that key can read rows.
It is for people shipping an app with Lovable, Bolt, Cursor, or Replit who want a daily check that the money path still works. You add the app URL and two test accounts that you control.
The daily check drives the app in a browser, so it is not tied to one framework. If signup, login, checkout, or the paid area is not linked from the homepage, you can set those paths. The Supabase anon-key check runs only when the public page contains a Supabase URL and an anon key. The secret scan reads public HTML and same-origin scripts.
No. The check pays your app with Stripe test card 4242 and expects the app to be in Stripe test mode. It does not enter a live card. BearWatch's own Starter and Studio plans are separate: those are billed through Stripe Checkout.
You give BearWatch the app URL and two test-account emails and passwords. Those passwords are stored encrypted. The check opens the pages those accounts can reach and saves screenshots of the run. The secret scan fetches the public HTML and same-origin scripts. You can also set an alert email and a Slack incoming webhook. The check does not ask for your Stripe secret key or your Supabase service role key.
The one-time public scan is free, and so is the app roast. Starter is $19 per month for one monitored app. Studio is $49 per month for up to five monitored apps. The Free plan does not include a daily check.
You paste a public URL. BearWatch fetches that page and its same-origin scripts and flags live secret keys such as sk_live_, a Supabase service_role JWT, and OpenAI keys. If the page also contains a Supabase URL and an anon key, it requests tables with only that key. The scan does not log in and does not pay. You can optionally email the report to yourself.
Paste a public URL on the roast page. No BearWatch account is required. BearWatch fetches that page once and grades HTTPS, security headers, exposed keys in public JavaScript, whether a Supabase anon key can read rows, links to login, signup, and pricing, the title and social tags, broken links on the homepage, load time and page weight, the favicon, and the mobile viewport tag. You get a grade from A to F, a short roast, and a prompt you can paste into Cursor or Lovable. An optional email sends the report and adds that address to the BearWatch list. The roast does not sign up, log in, or pay on the target app. The daily monitor does those checks on a schedule.
No. The anon key is meant to be in the browser. It is a problem only when row level security is off or a policy lets that key, or any logged-in user, read other people's rows. The service_role key is a secret. It bypasses row level security and must not appear in public HTML or JavaScript. BearWatch flags a JWT whose role is service_role. It does not flag the anon key by itself.
Email hello@bearwatch.space. That is the address for billing questions, a deletion request, and a check that did not match what you saw. The contact page is /contact.
After a Stripe Checkout subscription exists, open Billing in the dashboard and use the Stripe Customer Portal to cancel. When Stripe sends customer.subscription.deleted, BearWatch sets that account back to the Free plan. A subscription update with status canceled, unpaid, or incomplete_expired does the same. Apps already saved stay listed. Adding another monitored app then requires a paid plan.
There is no refund for a partial month. Cancel in Billing and the plan runs until the period ends. If a BearWatch outage stopped your checks, email hello@bearwatch.space within 14 days for a refund of that month. The full policy is on the terms page: /terms.