What exists today is an offline alpha with four narrow checks. The production Ship Kit is in development and cannot be bought yet. Prices on this page are planned pricing.
What Ship Kit is for
Ship Kit is planned as local developer tools, maintained rule packs, remediation guidance and structured evidence exports. You run supported checks on your own systems, fix what they find and keep a record of what was examined, with its limits.
| Interface | Current state |
|---|---|
| Local CLI | In the alpha: a zero-dependency Node CLI. |
| CI use | Planned. The alpha’s exit codes are not a release gate. |
| MCP adapter | Planned. Not built. |
| Evidence exports | In the alpha: JSON and Markdown reports. Structured exports for the production kit are planned. |
Try the alpha
Ship Kit alpha
Free
- For
- A developer evaluating whether the Ship Kit workflow fits their team.
- Outcome
- Run four narrow, offline checks on a local evaluation copy and read a report that states its own limits.
- Includes
- Zero-dependency Node CLI; Four assertions; Broken and corrected fixtures; Sample reports; Tests.
- Applies to
- The four checks read specific inputs: client artifact files, JS/TS source with NEXT_PUBLIC_ names, and GitHub Actions workflow files. See the coverage table.
- You need
- Node 20 or later; A local evaluation copy you are authorized to inspect
- Not included
- Not a universal scanner, penetration test, compliance engine or independent audit. Passing all four assertions completes no whole control.
- Updates
- Evaluation release. Later releases are not promised by this download.
- Support
- No support commitment for the alpha. Problems can be reported through the contact form.
- License
- Evaluation terms in LICENSE-ALPHA.md
Download the alpha (ZIP)See recorded results
Reviewed 2026-10-29
Quick start
- Install Node 20 or later. No packages are needed.
- Unzip the download and run
node demo.mjsinside it. It checks two synthetic fixtures and writes a report for each. - To check your own project, copy
example.scope.jsoninto an evaluation copy asnull-security.scope.jsonand point it at directories that already exist. - Run
node cli.mjs scan --project /path/to/copy --out /path/to/new-reportand readreport.md.
Use a local copy you are authorized to inspect, not a production server. The alpha makes no network requests, does not build or run your project and writes only the two report files.
Reading the results
- Pass: the narrow assertion holds for the inputs inspected, within its printed limits.
- Fail: a mismatch was observed. It is not automatically an exploitable vulnerability or a live credential.
- Inconclusive: some inputs were read, but missing context or unsupported syntax prevents a complete result.
- Not tested: no usable input was found. It is never a pass.
Troubleshooting
- Every check says not tested. The directories in your scope file must exist, relative to the project root. Build output such as
.next/statichas to be built first. - The CLI exits with code 2. Evidence was incomplete or the scope, project or output path was invalid. The message says which.
- A path is rejected. Absolute paths,
..segments and symbolic links are refused by design. - You are on macOS or Windows. The alpha’s tests ran on Linux; other systems have not been validated.
Coverage
These are the only automated checks released. Broad educational applicability is not evidence of automated compatibility: each check reads specific inputs, and anything outside them stays unexamined.
| Check | Required inputs | Supported syntax or environment | Status | Limitations |
|---|---|---|---|---|
NA-BUNDLE-01Recognizable secret indicators in client artifacts | Owner-selected client artifact directories (built files you ship) | UTF-8 text files. Patterns: sb_secret_, sk_live_/sk_test_, ghp_ prefixes and private-key headers. | Preview available in alpha 0.1.0 | Does not find unrecognized, encoded or transformed secrets. A match may be a synthetic value, not a live credential. |
NA-SOURCE-PUBLIC-01Public environment-variable names against an owner declaration | Owner-selected JS/TS source and a declared list of publishable names | Literal NEXT_PUBLIC_ identifiers (Next.js-style). Runtime versions not validated. | Preview available in alpha 0.1.0 | Does not validate values or the owner's decision. Dynamic access leaves the result incomplete. |
NA-CI-PIN-01Pinned GitHub Actions references | The selected GitHub Actions workflow directory | Line-oriented uses: declarations. Not a complete YAML parser. | Preview available in alpha 0.1.0 | Does not verify the referenced code or its dependencies. An actions.lock file makes the result inconclusive pending separate review. |
NA-CI-PERM-01Explicit default workflow token permissions | The selected GitHub Actions workflow directory | Limited top-level permissions: syntax. | Preview available in alpha 0.1.0 | Does not inspect job-level overrides, organization defaults or whether privileges are necessary. |
Planned licenses
Studio is a Ship Kit tier for teams doing client work, not a separate product. Neither license includes manual review, implementation work, custom rules or other PRAE products.
Ship Kit Individual
$399 per named user per yearPlanned pricing
- For
- One developer responsible for one or more systems.
- Outcome
- Repeat supported checks on your own projects, follow remediation guidance and export structured evidence.
- Includes
- Local developer tools; Maintained rule packs; Remediation guidance; Structured evidence exports.
- Applies to
- Automated coverage is limited to the checks, inputs and environments listed for each release.
- Not included
- Manual review, implementation work or custom rules. Every book, playbook or course.
- Updates
- To be stated before the license goes on sale.
- Support
- Bounded asynchronous product support, to be defined before sale.
Reviewed 2026-10-30
Ship Kit Studio
$1,490 per year for five named usersPlanned pricing
- For
- A studio or agency delivering systems to clients.
- Outcome
- Everything in Individual for a small team doing client work, with defined client-project use and report-handoff rights.
- Includes
- Five named users; Client-project use; Report-handoff rights.
- Applies to
- Same automated coverage as Individual.
- Not included
- Does not include every book, course or future product. Reports must not imply that PRAE performed an independent assessment.
- Updates
- To be stated before the license goes on sale.
- Support
- Bounded asynchronous product support, to be defined before sale.
Reviewed 2026-10-30
Before a license goes on sale
This page will state, for each license:
- The supported checks and environments for the release
- Named-user rights and project-use rights
- The update period and renewal terms
- How the tools behave offline and when a license expires
- The support scope
Reports you have already produced remain readable without a license.
Reports for clients
A Studio report handed to a client must say who ran the tool, what was examined, which version and scope were used and what remains unresolved. Your branding can appear on it; it must not suggest that PRAE performed an independent assessment.
Ship Kit and the pilot
The Ship Kit pilot brief describes a separate written agreement: $399 for one participant and one application, with terms set in that agreement. It is not the planned annual license, and a pilot does not convert into one.