We run the checks, you get the evidence. Our agent runs the 44 Ship Check launch and security checks on your AI-built app and hands back an evidence-backed SHIP-CHECK.md, with a paste-ready fix prompt for every failure, within 48 hours. $149, money back if it's late or not useful.
The Ship Check Kit is 44 launch and security checks your coding agent runs on your app. The audit is the same checks, run by our agent instead of yours, on your repo and your live or staging URL.
You get one file, SHIP-CHECK.md: a verdict, every check's result with the evidence behind it (the request and response, the query, the file:line), and for every failure a fix prompt you paste into Cursor, Claude Code, Lovable or Bolt. Your agent makes the change in your repo. We never need write access.
One-time payment via Stripe. You accept the terms below with a checkbox at checkout; then the intake page tells you how to give read-only access.
Late, or nothing in the report you needed to know? Message @zephosdev on X and you get the $149 back.
$ cat SHIP-CHECK.md
FAILSC-SEC-01 secrets in git history
FAILSC-RLS-02 anon key reads profiles
FAILSC-RLS-04 users can set plan='pro'
FAILSC-PAY-01 unsigned webhook accepted
WARNSC-PAY-03 no duplicate-event check
PASSSC-CORS-01 no arbitrary origins
DON'T LAUNCH· fix prompt per failure
From the kit's run on our deliberately broken sample app. The audit report uses the same check IDs and format.
01
What the audit covers
All 44 checks. Secrets, Supabase or Firebase access rules, auth and IDOR, admin routes, Stripe webhooks and entitlements, CORS, headers, rate limits and AI cost caps.
Live probes, with permission. Checks such as SC-RLS-02 and SC-PAY-01 send real requests to your app. We run them only against URLs you own and have authorised in writing, preferably staging.
Key rotation, verified. Every key that ever left the server is listed with where it leaked and a rotation order, and SC-SEC-03 confirms each old value now gets a 401 or 403, not just that a new one was added.
Read-only. Read-only access to the repo: the Read role on a repo in a GitHub organisation, or a git bundle of a personal repo (a collaborator on a personal repo gets write access, so we don't ask for that). Plus a URL, and a test account if login is involved. No write access, no production credentials.
02
What you get in 48 hours
SHIP-CHECK.md with a verdict and every result, severity-ranked; the evidence for each finding; a paste-ready fix prompt for each failure; a rotation list for any exposed keys; and the Ship Check Kit itself, so you or your agent can re-run the same checks after the fixes and see them pass. The 48 hours start once we have read access to the repo and your written OK for the live checks.
03
Other $149 audits, and how this one differs
There are other audits at this price. Some are human reviews where the fee is credited toward a paid fix sprint; some have AI agents draft the fixes and a human engineer approve each change before it ships. This one is agent-run, and labelled that way: no human engineer signs off. What you get instead is evidence you can check line by line, fixes your own agent applies in your repo (we never need write access), stable check IDs you can re-run with the included kit, and a money-back promise if it's late or tells you nothing you needed. If you want a person to approve every change, buy one of those.
03
Terms (you accept these at checkout)
$149 per app. One-time payment for one app: one repo plus its live or staging URL.
48 hours. Delivered within 48 hours of inputs complete: read-only repo access, plus your written OK for live checks or your choice of a code-only audit.
Read-only, always. The Read role on an org repo, or a git bundle of a personal repo. We never ask for write access, production database credentials or secret keys.
Live checks need your written OK. Nothing is sent to your app until you name the exact URLs in writing and confirm you own them or may test them. Without it, live checks are reported as not verified.
Agent-run, no human sign-off. The audit is run by our agent and labelled that way. No human engineer signs off on the report.
Money back. Late, or nothing in the report you needed to know? Message @zephosdev on X and you get the $149 back.
Kit included. The $29 Ship Check Kit comes with the report, so you can re-run the same checks after fixing.
$149 · one-time, per app
Ship Check Audit
One-time payment via Stripe. You accept the terms below with a checkbox at checkout; then the intake page tells you how to give read-only access. Support is a DM to @zephosdev on X.
One-time payment via Stripe. You accept the terms below with a checkbox at checkout; then the intake page tells you how to give read-only access.
Late, or nothing in the report you needed to know? Message @zephosdev on X and you get the $149 back.
A point-in-time, agent-run self-check against a fixed list, not a penetration test or a guarantee that your app is secure. The report says so, too. We only test apps you own or are authorised to test.
