Private betaThis is the SIGSHIP beta. Everything here is live for testers; the public launch is in January.SIGSHIP private betaOpen the app →
Incident rule

If a badge fails you, this is what we do. 

A badge should mean something, so we say in advance what happens when it lets you down.The published accountability rule for every badge level.

The rule

If an app that carries a SIGSHIP badge is breached through something one of our checks should have caught, we revoke the badge, publish a write-up, and add a new check through the Lookout.A breach of a badge-holding app through a class of problem a SIGSHIP check should have caught triggers: badge revocation, a public write-up, and a new check via the Lookout.

What counts

It counts when the way in was a problem a check already looks for, or one our checks should have looked for given what they promise: a leaked key, an open database table, an unverified payment message, an AI route with no limit, and the rest of the list.In scope: an initial access vector matching an existing rule, or a class the rules claim to cover (secrets, data access policies, webhook verification, rate limits, injection, and the rest of the check list). Out of scope: hosting account compromise, phishing, zero-days in platforms we do not scan.

What happens

  1. The badge is revokedRevocation. Within one working day of confirming the breach, the badge switches to Revoked and its record page says why.Within one working day of confirmation the badge state becomes revoked; the /verify/ record shows the reason.
  2. We write it upWrite-up. A public notice in the Lookout: what happened, what our check saw, what it should have seen, and what we changed. No details that would help an attacker, and nothing that names the victim without their agreement.A Lookout notice with the vector, what the check did and did not see, and the change. No exploit detail; the affected party is named only with consent.
  3. A new checkNew check. Within 14 days, the gap becomes a new check, or an existing check is widened, and it ships to the free tool as well as the paid plans.Within 14 days the gap lands as a new or widened rule, in the free tool and the Pro pack, with a test.
  4. The badge comes backReinstatement. After the fix, a fresh pass of the check restores the badge. For an Expert-reviewed badge the engineer reviews the fix first.A passing run after the fix restores the badge; Expert-reviewed badges need the signer’s review of the fix.

What this does not mean

A badge is not insurance and not a promise that the app is safe. It means the checks at that level found nothing that blocks launch, on the date shown. This rule is how we own it when the checks were not good enough.The badge is not a warranty. It records that the level’s checks passed on the date shown. This rule is our accountability when the checks were insufficient.

Reporting a breach

Owners, researchers and users can report one toReport to support@sigship.dev. We reply within one working day. Reports about SIGSHIP itself follow ourReplies within one working day. For vulnerabilities in SIGSHIP itself see security policy.

Incidents so far

None. This page lists every one, with a link to its write-up, the day there is one.None to date. Each incident is listed here with its Lookout write-up.