What an expert review covers. 

What a review covers

A SIGSHIP expert engineer reads your code by hand, in this order, and writes down what they found under each heading.A SIGSHIP expert engineer reviews the repository by hand against five areas, in order, and reports per area.

1. Logins and access. Who can sign in, who can see or change what, and whether an admin is decided on the server, not in the browser.Authentication, session handling, authorization on every route and database rule, role checks on the server.
2. User data. Where personal data lives, who can read it, and whether a stranger can read another user’s rows.Data model and access policies (for example RLS), exports, backups, deletion, and what logs contain.
3. Payments. That a payment message really came from your payment provider before anything is unlocked, and that prices and amounts are set on the server.Webhook signature verification, idempotency, server-side pricing, refund and cancellation paths.
4. Secret keys. That no key is in the code, the browser or the git history, and that each one has the least power it needs.Secrets in code, bundles and history; key scope and rotation; environment variable prefixes.
5. AI spending. That no feature can run up your AI bill without limit, and that what users type can’t take over your AI’s instructions.Rate limits and spend caps on model calls, prompt injection paths, model output rendered as HTML.

The review also runs the full SIGSHIP check, including the Pro pack, so the written review starts where the scanner stops.The engineer runs the CLI with the Pro pack first; the written review covers what pattern checks cannot see.

What it does not cover

A review reads your code. It does not test your live site from the outside, does not review your hosting account or dashboards, and is not a penetration test or a compliance audit. Anything out of scope is listed in the report so nobody assumes it was checked.Static review of the repository only. No live testing, no infrastructure or dashboard review, not a penetration test, not a SOC 2 or ISO audit. Out-of-scope items are listed in the report.

Who signs it

One named SIGSHIP expert engineer does the review and signs the report with their name and the review date. The same person is available for the 30-minute call.The reviewing engineer signs the report with name and date. One engineer per review; the signer takes the call.

How many we take

At most three reviews a week, so each one gets a full read. If the week is full you get the next open slot, and you can cancel for a full refund until work starts.Cap: three reviews per week. Written review within 48 hours of the start of your slot. Full refund until work starts.

What the report page shows

An app that passes gets the Expert-reviewed badge, and the badge links to a report page that anyone can open. It shows:The Expert-reviewed badge links to a public report page with:

• What was checked, under the five headings above.Scope: the five areas and the commit reviewed.
• What was found and fixed before the badge was issued, in plain words, without details that would help an attacker.Findings fixed before issue, summarised without exploit detail.
• What was out of scope.Out-of-scope list.
• The engineer’s name, the review date, and the SIGSHIP version used.Signer, date, sigship version.

The badge is valid for 12 months from the review date and the report says so. An app that changes a lot is reviewed again before the badge is renewed.Validity: 12 months from the review date, shown on the badge and the record. Renewal needs a new review.

Price

From $499, with a ranked, written review within 48 hours and a 30-minute call. Available now.From $499. Ranked written review in 48 hours plus a 30-minute call. Available now; request by email. Request an expert review.