Skip to content
Book a risk assessment

Ship Safe.

Security that keeps up with your release schedule.

Code, dependencies and secrets checked on every pull request. Pipelines and cloud set up safely. AI features tested against the OWASP Top 10 for LLM applications. And the evidence your enterprise customers ask for.

Price
$690 a month, up to 50 people
For
Software and fintech startups
Evidence for
SOC 2, ISO/IEC 27001, questionnaires
Start with Groundwork See the AI tests
Release 3.14 · Your productExample
  1. Commit
    Secrets
    Passed
  2. Pull request
    Code and dependencies
    1 blocked
  3. Build
    Container image
    Passed
  4. Deploy
    Infrastructure settings
    Passed
  5. Running
    Cloud and AI features
    2 warnings

Held at pull request: a library with a known exploited flaw. Upgrade suggested in the comment.

Every pull request

Findings show up where developers already work.

As comments on the pull request, with the fix. Only real, exploitable problems block a merge. Everything else is a comment, not a wall.

Pull request #214 · Add invoice exportExample
Example pull request checks
CheckFindingResult
SecretsNo keys, tokens or passwords in the changePassed
Code scan1 medium: user input reaches a SQL queryComment left
DependenciesA PDF library version has a known exploited flaw. Upgrade one minor version.Blocked
LicencesNo new licences that conflict with yoursPassed
AI prompt tests38 of 40 passed. 2 prompt injections via uploaded files got through.Warning
Leaked keys

Bots find leaked keys in minutes. So do we.

Automated scanners pick up public keys almost instantly. The race is decided by how fast the key stops working.

10:02:11

Key pushed

A cloud access key lands in a public repository.

10:02:40

Caught

29 seconds later. The developer and your lead get an alert.

10:04

Revoked

Key disabled and rotated. Nothing depends on it now.

10:06

Checked

Cloud logs show it was never used.

10:30

Prevented

A commit check now stops that key type before it leaves a laptop.

AI features

Tested against the OWASP Top 10 for LLM applications.

If your product has a chatbot, an agent or retrieval over customer data, these are the ten ways it gets abused. Each one has tests in your pipeline.

LLM01
Prompt injection
Instructions hidden in uploads, emails and web pages
LLM02
Sensitive information disclosure
Customer data leaking through answers
LLM03
Supply chain
Models, plugins and datasets you depend on
LLM04
Data and model poisoning
Tampered training or retrieval data
LLM05
Improper output handling
Model output trusted by code or browsers
LLM06
Excessive agency
Agents with more power than the job needs
LLM07
System prompt leakage
Secrets and rules exposed through the prompt
LLM08
Vector and embedding weaknesses
One customer's data reachable by another
LLM09
Misinformation
Confident wrong answers in your product
LLM10
Unbounded consumption
Runaway cost and denial of service
Evidence

The questionnaire stops holding up the deal.

Enterprise customers send 200-question security reviews. Most answers come straight from what Ship Safe already does, with the evidence attached. It lines up with SOC 2 and ISO/IEC 27001 when you get there.

Customer security questionnaire · 4 of 212Example
  • Do you scan code for vulnerabilities before release?
    Yes. Every pull request. Evidence: last 90 days of scan results.
  • How do you manage secrets?
    In a vault, never in code. Commit scanning blocks keys. Evidence: policy and alert log.
  • Do you test your AI features for misuse?
    Yes, against the OWASP Top 10 for LLM applications. Evidence: test report.
  • Do you monitor your cloud for misconfiguration?
    Continuously. Evidence: monthly posture report.
Price

$690 a month up to 50 people.

Then $1,035 up to 150 people, $1,380 up to 300 and $1,725 up to 500. Covers your repositories, pipelines and one cloud environment. Each extra environment is $190 a month.

Works well withStartup PackHardenedExpert Hours

Your next enterprise deal will ask about security. Have the answer ready.

Start with Groundwork. Ship Safe plugs into your pipeline the week after.

Book Groundwork