A build that compiles and a test suite that passes answer a narrower question than most teams think. These are the 17 gates a free ShipGate scan runs on top.
None of the following makes a build fail. That is the gap — not a criticism of your compiler or your test suite, which were never asked these questions.
Static analysis for hardcoded secrets, SQL injection vectors, authentication bypass patterns, and weak cryptographic primitives in source code.
Tracks unsanitized user input flowing to SQL execution, shell commands, XSS sinks, or eval — classic injection attack vectors.
Audits lockfile integrity, known CVEs in dependencies, and suspicious package names that may be typosquats or supply-chain attacks.
Runs Semgrep rules tuned for AI-generated code patterns — common mistakes LLMs make when generating production code.
Ensures Stripe and other webhook route handlers verify signatures (constructEvent, signature header validation) before processing payloads.
A spec-free static scan is advisory. It reports CLEAR, BLOCKED, or UNVERIFIED against the exact revision you handed it — it never issues SHIP, and it is not a green check you can put in front of a merge. Authorising a release takes a run of that revision through the signed pipeline.
