Free today. Bigger powers soon.
Prices for paid plans are early estimates and may change before launch. Every paid feature says whether it is built today or the month it rolls out by. The free check is open source and stays free.
Like an app you install. Runs on your computer and in your own GitHub; your code never leaves.
Free
LiveThe open source check for every AI-built app.
- ✓17 core checks
- ✓Unlimited repos, on your machine
- ✓Terminal, browser dashboard and MCP
- ✓Pull request check for GitHub
- ✓Fix prompt for any AI tool
- ✓JSON and Markdown output
Open source under MIT. No account, no card, no limits.
Check my appPro
WaitlistEvery check we have, on your own machine and CI.
- ✓Pro pack of 7 extra checksAt launch
- ✓Client-ready HTML reportAt launch
- ✓Pull request comments and nightly checksAt launch
- ✓Slack alert when a nightly check failsAt launch
- ✓Deep Supabase policy checkBy December
- ✓Security headers and login rate limitsBy December
Includes 1 year of new checks. Keep it forever.
Join waitlistBusiness
WaitlistFor studios and agencies shipping client apps.
- ✓25 repos
- ✓White-label client reportsBy December
- ✓Priority support
- ✓Unlimited team members
Includes 1 year of new checks. Keep it forever.
Join waitlistLike Gmail: we run it for you and watch your live apps every night. Every Cloud plan includes every Pro check.
Solo
BetaFor a founder with an app in production.
- ✓Connect through GitHub, for apps from Lovable, Bolt, Replit and v0By January
- ✓Checks on every push and every nightBy January
- ✓Live site scan, 1 site dailyBy January
- ✓Live Supabase probeBy January
- ✓SSL, domain and downtime alertsBy January
- ✓New vulnerability alertsBy January
Yearly billing saves 20%. Cancel anytime. 14-day trial, no card. A feature that misses its date is refunded on request.
Buy SoloTeam
BetaFor small teams shipping every week.
- ✓10 projects and 5 seatsBy February
- ✓Live site scans, 10 sites hourlyBy February
- ✓Draft fix pull requests for simple problemsBy February
- ✓Pull request comments and merge blockBy February
- ✓Slack, Discord and email alertsBy February
- ✓Roles and activity logBy February
Yearly billing saves 20%. Cancel anytime. 14-day trial, no card. A feature that misses its date is refunded on request.
Buy TeamAgency
BetaFor agencies running many client apps.
- ✓30 projects and 15 seatsBy February
- ✓Live site scans, 30 sites hourlyBy February
- ✓White-label client reportsBy February
- ✓An alert channel per clientBy February
- ✓Sign in with Google or GitHubBy January
- ✓Onboarding call
Yearly billing saves 20%. Cancel anytime. 14-day trial, no card. A feature that misses its date is refunded on request.
Buy AgencyAt launch: built and in use todayBy December: rolling out by December 2026By January: rolling out by January 2027By February: rolling out by February 2027A feature that misses its date is refunded on request.
Expert review · from $499
A SIGSHIP expert engineer reads your code by hand against the review protocol and sends a ranked, written review within 48 hours, with a 30-minute call. Available now, three a week.
| Feature | Free | Pro | Business | Solo | Team | Agency |
|---|---|---|---|---|---|---|
| Plan | ||||||
| Repos or projectsHow many codebases the plan covers. | Unlimited | 5 | 25 | 3 | 10 | 30 |
| Team membersWho can use it. Self-hosted plans have no seat limit. | Unlimited | Unlimited | Unlimited | 1 | 5 | 15 |
| New checks and updatesSelf-hosted paid plans include a year of new checks. You keep what you have after that. | Always | 1 year | 1 year | Always | Always | Always |
| Checks | ||||||
| 17 core checksLeaked keys, committed .env files, open Supabase tables, unverified Stripe webhooks, AI routes with no spending brake and more. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Pro pack, 7 checksOpen Firebase rules, public storage buckets, routes that change data with no auth, Razorpay webhooks, upload limits, open redirects and weak session cookies. | — | ✓At launch | ✓At launch | ✓By January | ✓By January | ✓By January |
| Known vulnerable packagesBy DecemberAn opt-in online check: add --online and SIGSHIP sends package names and versions to the OSV advisory database, nothing else. Free for everyone. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Deep Supabase policy checkFinds policies that exist but do not restrict anything, the service key used in the browser, and email confirmation turned off. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| Security headersContent security policy, clickjacking protection and HSTS in your Next.js, Vercel or Netlify config. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| Login and signup rate limitsCatches auth endpoints anyone can hammer with guesses. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| Hallucinated and look-alike packagesAI tools sometimes invent package names, and attackers register them. SIGSHIP flags packages that look wrong. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| Secrets in git historyFinds keys that were committed once and deleted later. They are still in your history. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| AI app checksUser input pasted into system prompts, and AI output rendered as raw HTML. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| More payment webhooksPaddle, Lemon Squeezy and Polar, as well as Stripe and Razorpay. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| Fix | ||||||
| Fix prompt for any AI toolEvery finding as one prompt you can paste into your AI tool. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Prompts tuned for your toolFix prompts written for Lovable, Cursor, Bolt, Claude Code and Replit. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| Draft fix pull requests for simple problemsBy FebruarySIGSHIP opens a draft pull request with the fix for three mechanical problems: a CORS wildcard, a secret in logs and a missing lockfile. You review and merge it. | — | — | — | — | ✓ | ✓ |
| Automatic re-check after a fixBy JanuaryPush a fix, and SIGSHIP checks again on its own. | — | — | — | ✓ | ✓ | ✓ |
| Where it runs | ||||||
| Terminal, browser dashboard and MCPRun it yourself, click through results in your browser, or give it to your coding agent. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Pull request checkA GitHub check that fails when a change brings a serious problem back. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Pre-commit hookBy DecemberStops a secret before it is ever committed. | — | ✓ | ✓ | — | — | — |
| GitHub code scanningFindings appear in the Security tab of your GitHub repo. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| Pull request comments and nightly checksResults posted on each pull request, and a check every night. | — | ✓At launch | ✓At launch | ✓By January | ✓By January | ✓By January |
| Connect through GitHubBy JanuaryConnect apps from Lovable, Bolt, Replit and v0 through their GitHub sync. Nothing to install. | — | — | — | ✓ | ✓ | ✓ |
| Watch | ||||||
| Live site scanChecks your deployed site from the outside: exposed .env or .git, source maps, missing headers and open admin pages. | — | — | — | 1 site, dailyBy January | 10 sites, hourlyBy February | 30 sites, hourlyBy February |
| Live Supabase probeBy JanuaryTries your public key the way an attacker would and reports which tables it can read, never the rows. | — | — | — | ✓ | ✓ | ✓ |
| SSL, domain and downtime alertsBy JanuaryWarns you before a certificate or domain expires, and when the site goes down. | — | — | — | ✓ | ✓ | ✓ |
| New vulnerability alertsBy JanuaryTells you when a package you use gets a new security advisory. | — | — | — | ✓ | ✓ | ✓ |
| Reports | ||||||
| Terminal, JSON and Markdown outputFor people, scripts and pull request comments. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Client-ready reportA clean HTML report to send to a client or investor. | — | ✓At launch | ✓At launch | ✓By January | ✓By January | ✓By January |
| Pre-launch checklistA one-page checklist showing what was checked before launch. Print it to PDF. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| White-label reportsYour logo and name on client reports. | — | — | ✓By December | — | — | ✓By February |
| Launch readiness score and historyBy JanuaryA score from 0 to 100 with a published formula, and a graph of your app getting safer. | — | — | — | ✓ | ✓ | ✓ |
| Badge for your siteComes with the plan, never sold alone. Each badge has its own ID and links to its record on sigship.dev. It never claims your app is certified. | Self-checked | Deep self-checkBy December | Deep self-checkBy December | Checked dailyBy January | Live-checkedBy February | Live-checkedBy February |
| Team and control | ||||||
| Accepted risks fileMark a finding as known, with a reason and an expiry date, so it stops blocking. | — | ✓By December | ✓By December | ✓By January | ✓By January | ✓By January |
| AlertsWhere SIGSHIP tells you when something turns NO-GO. | — | SlackAt launch | SlackAt launch | EmailBy January | Slack, Discord, emailBy February | All, plus a channel per clientBy February |
| Roles and activity logBy FebruaryWho can do what, and a record of what changed. | — | — | — | — | ✓ | ✓ |
| Sign in with Google or GitHubBy JanuaryOne click to sign in. No passwords to keep. | — | — | — | ✓ | ✓ | ✓ |
| Support | ||||||
| SupportHow to reach us. | Community | Priority | Priority | Onboarding call | ||
At launch: built and in use todayBy December: rolling out by December 2026By January: rolling out by January 2027By February: rolling out by February 2027A feature that misses its date is refunded on request.
Questions
Is the free version really free?
Yes. It's open source (MIT) and runs on your computer. No account, no limits on projects, no card.
Do you upload my code?
Never in the free version: it makes no network calls at all. With a licence key it sends only the key and a one-way repo fingerprint. Cloud will read only the apps you connect, in an isolated runner, and you can disconnect any time.
Does a 'Ready' mean my app is 100% safe?
No tool can promise that. It means our 17 checks found nothing blocking launch. It does not prove the app is safe.
What does one-time mean?
Pay once and use it for as long as you like. The price includes a year of new checks. After that you can renew, or keep the version you have.
When do paid plans open?
Soon. Join the waitlist and we'll email you once, when your plan opens, with launch pricing.
What do the dates next to features mean?
“At launch” means the feature is built and in use today. “By December”, “By January” or “By February” means it is being built and rolls out by then. A feature that misses its date is refunded on request.
What if it isn't right for me?
Ask within 14 days of your first payment for a full refund. A feature that misses its date is refunded on request.