ShipGate runs a fixed catalog of 28 gates — the same catalog on a WholeStack build and on a repository we have never touched. A verdict is SHIP only when every applicable gate passes, and the evidence is bound to the exact artifact hash that was checked. This page is the catalog, not somebody's run.
Gates in the catalog
28
named checks, not a sample
Run on a free repo scan
17
advisory CLEAR / BLOCKED
Gate categories
6
security through platform
Cost to scan a repo
$0
monthly cap on free accounts
The catalog
Gates marked for repository scans run on any repo you point us at, free. The rest apply to governed WholeStack builds and platform certification, where a spec and a signed manifest exist to check against.
Security
Integrity
Boundary
Contract
Runtime
Platform
What ShipGate stops
Everything ShipGate stops
ShipGate is the sole release authority. These patterns never earn SHIP — fix them or regenerate through WholeStack.
Fake success UI (catch + toast.success)
Stubbed / not-implemented functionality
Undeclared npm dependencies (phantom imports)
Direct prisma mutations in API routes
Sensitive routes without authentication
Unsigned webhook handlers
Hardcoded secrets and credentials
SQL injection and XSS vectors
Mock/demo data in production paths
Forbidden state transitions that succeed
Unauthorized role access to commands
Missing evidence for release-blocking clauses
Generated files without provenance records
Ungoverned database mutations
Cross-tenant persistence bypasses
Deployment without signed manifest
Dirty worktree SHIP attempts
Post-SHIP artifact changes without re-verification
Run the register against your repository
Free accounts get a monthly scan cap — point ShipGate at a repository and read the per-gate result. Continuous enforcement on every pull request, with the verdict history kept, is ShipGate CI at $50/month. A scan never mints a signed SHIP.