SIGSHIPFeatures
Everything it does. In plain English.
SIGSHIP reads the code your AI tool wrote and tells you, before launch, what will leak, break or cost you money. Then it hands you the fix.
Catches the mistakes that cost you.
17 checks, chosen from how AI-built apps actually fail: leaked keys, open databases, fake payments and runaway AI bills. Tap any check to see what goes wrong and how to fix it.
SEV-1 · 8 checks
Blocks launch. Puts your data or money at risk.
SEV-2 · 3 checks
Blocks launch. Makes abuse easy.
SEV-3 · 6 checks
Worth fixing. Blocks only in strict mode.
Fixes with the AI tool you already use.
Every problem comes with a plain fix. Run npx sigship --prompt and you get one prompt with every fix, in order, ready to paste into Lovable, Cursor, Bolt, Replit or Claude Code.
Your AI tool makes the changes. Run SIGSHIP again, and when it says GO, nothing serious is left.
Fix these production problems in order. Change only what each fix needs.
After the fixes, run `npx sigship` again and keep going until it exits 0.
If a fix needs a key rotated or a dashboard changed, stop and tell me what to do.
1. [SEV-1] Your Stripe webhook accepts anything
Where: src/api/stripe-webhook.ts:3
Fix: Verify every event with stripe.webhooks.constructEvent, using the raw request body and your webhook signing secret, before you act on it.
2. [SEV-1] A database table has no row level security
Where: supabase/migrations/001_init.sql:1
Fix: Add "alter table <name> enable row level security;" in a new migration, then write a policy that limits each row to its owner.
3. [SEV-2] Your AI route has no spending brake
Where: src/api/chat.ts:2
Fix: Add a per-user and per-IP rate limit in front of this route, plus a monthly spending cap in your AI provider dashboard.Runs where you work.
Your terminal
One command, no signup. A clear GO or NO-GO in seconds.
Your browser
Prefer buttons? npx sigship ui opens a private dashboard on your own computer.
Every pull request
A GitHub check that fails when a change brings a serious problem back.
Your AI coding agent
Connect it to Claude Code, Cursor and others, with one rule: the job isn't done until SIGSHIP says GO.
AI agents →Private by design.
Nothing leaves your machine
The free tool makes no network calls. Your code, keys and findings stay with you.
Never prints a secret
When it finds a leaked key it tells you where, never what.
Open source
Free to use, with all the code public on GitHub, so anyone can check what it does.
GitHub →An honest verdict
GO means these checks found nothing that blocks launch. It does not prove your app is safe, and we say so.
Coming with paid plans.
Planned features, on the waitlist. They arrive at launch.
More checks
Deeper Supabase policy checks, security headers, login rate limits, risky packages and secrets in your git history.
Reports for clients
A clean report and a pre-launch checklist you can send to a client or investor.
SIGSHIP Cloud
Connect a repo once. We check every change and watch your live site, and tell you what to fix in plain English.
Check your app before your users do.
Free, open source, and nothing leaves your machine.
$ npx sigship