ShipSafe · School

ShipSafe School

A free course on shipping AI-built apps without getting hacked or losing money. Each lesson ends with a lab: attack a simulated app, then fix it. 6 modules, 23 lessons, 23 labs (6 flagship).

Start the first lab Free, no signup. Progress stays in this browser.

1. 01
   Secrets and API keys

   Keep keys out of git, out of the browser, and rotate them when they leak. 4 lessons.

   • Keep .env files out of git flagship lab
   • No secret keys in the browser bundle quiz
   • Rotate a leaked key the same day lab
   • Turn on secret scanning before the next push quiz
2. 02
   Auth and database rules

   Supabase RLS, Firebase rules, and server-side ownership checks so one user cannot read another. 4 lessons.

   • Turn on Supabase RLS on every table flagship lab
   • Keep the service_role key on the server quiz
   • Check ownership on the server (stop IDOR) lab
   • Keep storage buckets private by default quiz
3. 03
   Payments that cannot be cheated

   Server-side prices, signed webhooks, idempotency and subscription sync for Stripe. 4 lessons.

   • Never trust prices from the client flagship lab
   • Verify every webhook signature lab
   • Handle retries and duplicate events quiz
   • Keep subscription state in sync with Stripe quiz
4. 04
   Deploys and config

   Env vars, preview exposure, headers and CSP, and open admin routes. 4 lessons.

   • Set env vars per environment flagship lab
   • Keep previews away from production data lab
   • Lock down headers and CSP quiz
   • Don't leave debug or admin routes public quiz
5. 05
   AI bots and SEO

   robots.txt for AI crawlers, llms.txt basics, and what training bots do. 3 lessons.

   • How robots.txt decides allow vs block flagship lab
   • Training bots vs search and user-fetch bots lab
   • What llms.txt is (and is not) quiz
6. 06
   Monitoring and incidents

   Logs, rate limits, key rotation and spend caps when something goes wrong. 4 lessons.

   • Rate limit expensive and auth endpoints flagship lab
   • Cap AI spend and set billing alerts quiz
   • Log errors without logging secrets lab
   • Your first hour after a leak quiz

Labs are fully simulated and run in your browser. No real keys, no real network attacks, nothing leaves this device except the optional share link you copy yourself.