SIGSHIPPricing
The free tool works today with no signup and no card. Paid plans are on the waitlist and open soon. First, pick how you want to run it.
Pay once and keep it. Includes a year of new checks.
The open source check for every AI-built app.
$0forever
What you get
Best for most
Every check we have, on your own machine and CI.
$149one-time
Join the waitlistEverything in Free, plus
For studios and agencies shipping client apps.
$499one-time
Join the waitlistEverything in Pro, plus
| Repos or projectsHow many codebases the plan covers. | Unlimited | 5 | 25 |
|---|---|---|---|
| Team membersWho can use it. Self-hosted plans have no seat limit. | Unlimited | Unlimited | Unlimited |
| New checks and updatesSelf-hosted paid plans include a year of new checks. You keep what you have after that. | Always | 1 year | 1 year |
| 17 core checksLeaked keys, committed .env files, open Supabase tables, unverified Stripe webhooks, AI routes with no spending brake and more. | Included | Included | Included |
|---|---|---|---|
| Pro packOpen Firebase rules, public storage buckets, routes that change data with no auth, Razorpay webhooks, upload limits, open redirects and weak session cookies. | Not included | Included | Included |
| Deep Supabase policy checkFinds policies that exist but do not restrict anything, the service key used in the browser, and email confirmation turned off. | Not included | Included | Included |
| Security headersContent security policy, clickjacking protection and HSTS in your Next.js, Vercel or Netlify config. | Not included | Included | Included |
| Login and signup rate limitsCatches auth endpoints anyone can hammer with guesses. | Not included | Included | Included |
| Hallucinated and look-alike packagesAI tools sometimes invent package names, and attackers register them. SIGSHIP flags packages that look wrong. | Not included | Included | Included |
| Known vulnerable packagesChecks your dependencies against public security advisories. | Not included | Included | Included |
| Secrets in git historyFinds keys that were committed once and deleted later. They are still in your history. | Not included | Included | Included |
| AI app checksUser input pasted into system prompts, and AI output rendered as raw HTML. | Not included | Included | Included |
| More payment webhooksPaddle, Lemon Squeezy and Polar, as well as Stripe and Razorpay. | Not included | Included | Included |
| Fix prompt for any AI toolEvery finding as one prompt you can paste into your AI tool. | Included | Included | Included |
|---|---|---|---|
| Prompts tuned for your toolFix prompts written for Lovable, Cursor, Bolt, Claude Code and Replit. | Not included | Included | Included |
| Terminal, browser dashboard and MCPRun it yourself, click through results in your browser, or give it to your coding agent. | Included | Included | Included |
|---|---|---|---|
| Pull request checkA GitHub check that fails when a change brings a serious problem back. | Included | Included | Included |
| Pre-commit hookStops a secret before it is ever committed. | Not included | Included | Included |
| GitHub code scanningFindings appear in the Security tab of your GitHub repo. | Not included | Included | Included |
| Pull request comments and nightly checksResults posted on each pull request, and a check every night. | Not included | Included | Included |
| Terminal, JSON and Markdown outputFor people, scripts and pull request comments. | Included | Included | Included |
|---|---|---|---|
| Client-ready reportA clean HTML report to send to a client or investor. | Not included | Included | Included |
| Pre-launch checklist PDFA one-page checklist showing what was checked before launch. | Not included | Included | Included |
| White-label reportsYour logo and name on client reports. | Not included | Not included | Included |
| Accepted risks fileMark a finding as known, with a reason and an expiry date, so it stops blocking. | Not included | Included | Included |
|---|---|---|---|
| AlertsWhere SIGSHIP tells you when something turns NO-GO. | Not included | Slack, Discord, email | Slack, Discord, email |
| SupportHow to reach us. | Community | Priority |
|---|
Every Cloud plan includes every Pro check. The free tool still works on your machine.
For a founder with an app in production.
$19a month
Join the waitlistAll Pro checks, plus
Best for most
For small teams shipping every week.
$59a month
Join the waitlistEverything in Solo, plus
For agencies running many client apps.
$149a month
Join the waitlistEverything in Team, plus
| Repos or projectsHow many codebases the plan covers. | 3 | 10 | 30 |
|---|---|---|---|
| Team membersWho can use it. Self-hosted plans have no seat limit. | 1 | 5 | 15 |
| New checks and updatesSelf-hosted paid plans include a year of new checks. You keep what you have after that. | Always | Always | Always |
| 17 core checksLeaked keys, committed .env files, open Supabase tables, unverified Stripe webhooks, AI routes with no spending brake and more. | Included | Included | Included |
|---|---|---|---|
| Pro packOpen Firebase rules, public storage buckets, routes that change data with no auth, Razorpay webhooks, upload limits, open redirects and weak session cookies. | Included | Included | Included |
| Deep Supabase policy checkFinds policies that exist but do not restrict anything, the service key used in the browser, and email confirmation turned off. | Included | Included | Included |
| Security headersContent security policy, clickjacking protection and HSTS in your Next.js, Vercel or Netlify config. | Included | Included | Included |
| Login and signup rate limitsCatches auth endpoints anyone can hammer with guesses. | Included | Included | Included |
| Hallucinated and look-alike packagesAI tools sometimes invent package names, and attackers register them. SIGSHIP flags packages that look wrong. | Included | Included | Included |
| Known vulnerable packagesChecks your dependencies against public security advisories. | Included | Included | Included |
| Secrets in git historyFinds keys that were committed once and deleted later. They are still in your history. | Included | Included | Included |
| AI app checksUser input pasted into system prompts, and AI output rendered as raw HTML. | Included | Included | Included |
| More payment webhooksPaddle, Lemon Squeezy and Polar, as well as Stripe and Razorpay. | Included | Included | Included |
| Fix prompt for any AI toolEvery finding as one prompt you can paste into your AI tool. | Included | Included | Included |
|---|---|---|---|
| Prompts tuned for your toolFix prompts written for Lovable, Cursor, Bolt, Claude Code and Replit. | Included | Included | Included |
| One-click fix pull requestsSIGSHIP opens a pull request with the fix for simple problems. | Not included | Included | Included |
| Automatic re-check after a fixPush a fix, and SIGSHIP checks again on its own. | Included | Included | Included |
| Terminal, browser dashboard and MCPRun it yourself, click through results in your browser, or give it to your coding agent. | Included | Included | Included |
|---|---|---|---|
| Pull request checkA GitHub check that fails when a change brings a serious problem back. | Included | Included | Included |
| GitHub code scanningFindings appear in the Security tab of your GitHub repo. | Included | Included | Included |
| Pull request comments and nightly checksResults posted on each pull request, and a check every night. | Included | Included | Included |
| Connect from AI buildersConnect projects from GitHub, Lovable, Bolt, Replit and v0. Nothing to install. | Included | Included | Included |
| Live site scanChecks your deployed site from the outside: exposed .env or .git, source maps, missing headers and open admin pages. | 1 site, daily | 10 sites, hourly | 30 sites, hourly |
|---|---|---|---|
| Live Supabase probeTries your public key the way an attacker would and reports which tables it can read. | Included | Included | Included |
| SSL, domain and downtime alertsWarns you before a certificate or domain expires, and when the site goes down. | Included | Included | Included |
| New vulnerability alertsTells you when a package you use gets a new security advisory. | Included | Included | Included |
| Terminal, JSON and Markdown outputFor people, scripts and pull request comments. | Included | Included | Included |
|---|---|---|---|
| Client-ready reportA clean HTML report to send to a client or investor. | Included | Included | Included |
| Pre-launch checklist PDFA one-page checklist showing what was checked before launch. | Included | Included | Included |
| White-label reportsYour logo and name on client reports. | Not included | Not included | Included |
| Launch readiness score and historyA score from 0 to 100, and a graph of your app getting safer. | Included | Included | Included |
| "Checked by SIGSHIP" badgeA badge for your site showing the latest verdict. It never claims your app is certified. | Included | Included | Included |
| Accepted risks fileMark a finding as known, with a reason and an expiry date, so it stops blocking. | Included | Included | Included |
|---|---|---|---|
| AlertsWhere SIGSHIP tells you when something turns NO-GO. | Slack, Discord, email | All, plus a channel per client | |
| Roles and activity logWho can do what, and a record of what changed. | Not included | Included | Included |
| Single sign-onSign in with your company identity provider. | Not included | Not included | Included |
| SupportHow to reach us. | Priority | Onboarding call |
|---|
A senior zoof04 engineer reviews your repo by hand. You get a ranked written review within 48 hours, a 30-minute call, and fix prompts for your AI tool.
$499from, one-time
Request a pilot reviewYes. It's open source under the MIT licence, needs no signup, has no repo limit and runs on your machine for as long as you like.
Self-hosted runs on your own computer and GitHub, like an app you install: your code never leaves. Cloud is run for you, like Gmail: connect a repo and we check every change and watch your live site.
Not with self-hosted. With a licence key it sends only the key and a one-way repo fingerprint. Cloud will read your code in an isolated runner, delete it within minutes and keep only the findings.
Pay once and use it for as long as you like. The price includes a year of new checks. After that you can renew, or keep the version you have, forever.
Soon. Join the waitlist and we'll email you once, when your plan opens, with launch pricing.
Ask within 14 days of your first payment for a full refund. Non-profits and students get a discount: email support@sigship.dev.
Free, open source, and nothing leaves your machine.
$ npx sigship