# PRAE Ship Kit pilot

**Proposed pilot fee: $399 for one named participant and one application.** The written pilot agreement sets the access period, support allowance and permitted client use. This page is an offer for discussion, not a purchase contract or a commitment to deliver unbuilt features.

## A repeatable security workflow before a client handoff

The Ship Kit pilot is for a small studio delivering a Next.js application on Vercel with a hosted Supabase backend. It helps one implementation owner run a defined set of checks, fix supported findings and prepare an evidence report a client can understand.

We are inviting inquiries for the first three learning pilots. The commercial kit is in development. Participation, start date, supported versions and the exact feature set are agreed before payment.

## Who the pilot is for

- A studio or product team with someone able to change and test its application.
- A Next.js App Router application deployed on Vercel, using hosted Supabase for its backend.
- One named application and an authorized test environment, with synthetic accounts and data available if the agreed workflow includes runtime checks.
- A team willing to share feedback on usability, missing guidance and time spent. Source code and production data are not needed to discuss a pilot.

The first pilot does not cover other frameworks, self-hosted infrastructure, native mobile clients or an organization-wide security program. Optional features such as Stripe billing, AI calls or client-accessible Storage are listed explicitly in the scope; having them in the stack does not mean the pilot tests them.

## The job we agree

At intake we choose one bounded workflow for the application, naming its inputs, supported checks, evidence and completion criteria. A typical run:

1. Record the application, environment, build, owner and supported configuration.
2. Run the agreed checks, and separate findings from missing or inconclusive evidence.
3. Follow the guidance to correct confirmed findings within the pilot scope.
4. Rerun the affected checks and keep the before-and-after results.
5. Produce a dated handoff report with the tested scope, results, unresolved items and next actions.

A pilot is useful even when nothing is found: the report still records what was examined and the limits of those results. Passing a small set of checks does not establish that the application is secure or that a whole control is met.

## What is available now

The offline alpha provides four narrow assertions:

| Assertion | What it examines |
| --- | --- |
| Recognized secret indicators | Owner-selected client artifacts, using specified recognizable formats |
| Public environment-variable names | Literal `NEXT_PUBLIC_` names compared with an owner-declared list |
| Action references | Supported GitHub Actions references, checked for full commit-hash pins |
| Workflow token permissions | Explicit default permissions in supported workflow syntax |

The alpha ships with synthetic broken and corrected examples and sample reports. It does not run the application, make network calls, read deployed settings, decide legal obligations or provide an MCP adapter. Unrecognized syntax and missing inputs stay unresolved, and its reports contain assertion results, not a completed assessment. [See it on the bench.](https://nullventures.co/security/#bench)

The pilot agreement names which released capabilities are included at its start. Future functionality is not included by implication.

## What the participant receives

- Access to the named pilot release and its documentation.
- A worked example of the agreed workflow, from finding to correction and retest.
- Implementation guidance and evidence templates for that workflow.
- A stated support allowance for setup and interpreting results.
- A dated evidence report for the named application and scope, labeled as the team’s own self-assessment.

Implementation stays with your team. Any request for Null to change the application or run additional testing needs a separate scope. Licenses after the pilot, update periods and future versions are agreed separately and are not assumed from the pilot fee.

## Information we need to scope a pilot

1. What the application does, and the launch or handoff you are preparing for.
2. Framework and package versions, hosting, and the Supabase features you use.
3. Whether there are several customer organizations, payments, file uploads, AI models or agents.
4. The implementation owner, and the person who can authorize testing.
5. The outcome you want, and your existing test environment.

Send descriptions and versions at this stage. Do not send secrets, production records or unrestricted credentials.

## How we judge the result

We record whether the participant completes the agreed workflow, what changed in the application, which evidence was useful and how much support was needed. We also record missed cases, confusing results and requests that fell outside scope.

Your results stay private unless we make a separate, explicit publication agreement. Taking part does not authorize a testimonial, logo use or a public case study.

*PRAE, a NULL Ventures company. Pilot brief v0.2, 29 October 2026.*

Inquiries: https://nullventures.co/security/?topic=ship-kit#inquire