Proof register
Every gate, published
ShipGate runs a fixed catalog of 28 gates — the same catalog on a WholeStack build and on a repository we have never touched. A verdict is SHIP only when every applicable gate passes, and the evidence is bound to the exact artifact hash that was checked.
- Gates in the catalog
- 28
- Run on a free repo scan
- 17
- Gate categories
- 6
- Cost to scan a repo
- $0
The catalog
Gates marked for repository scans run on any repo you point us at, free. The rest apply to governed WholeStack builds and platform certification, where a spec and a signed manifest exist to check against.
Security
Integrity
Boundary
Contract
Runtime
Platform
What ShipGate stops
Everything ShipGate stops
ShipGate is the sole release authority. These patterns never earn SHIP — fix them or regenerate through WholeStack.
- Fake success UI (catch + toast.success)
- Stubbed / not-implemented functionality
- Undeclared npm dependencies (phantom imports)
- Direct prisma mutations in API routes
- Sensitive routes without authentication
- Unsigned webhook handlers
- Hardcoded secrets and credentials
- SQL injection and XSS vectors
- Mock/demo data in production paths
- Forbidden state transitions that succeed
- Unauthorized role access to commands
- Missing evidence for release-blocking clauses
- Generated files without provenance records
- Ungoverned database mutations
- Cross-tenant persistence bypasses
- Deployment without signed manifest
- Dirty worktree SHIP attempts
- Post-SHIP artifact changes without re-verification
Run the register against your repository
Free accounts get a monthly scan cap — point ShipGate at a repository and read the per-gate result. Continuous enforcement on every pull request, with the verdict history kept, is ShipGate CI at $50/month.