Example assessment report.
Recorded results from running the Ship Kit alpha against deliberately broken synthetic fixtures, then against the corrected versions. Nothing about your system was inspected.
Recorded assertion results
Fixture state
0/4Assertions passing
0Controls marked met
- The interactive comparison needs JavaScript. The complete before and after reports are available below.
Four passes still complete no control. Each assertion checks one narrow thing and prints what it does not establish. A whole control needs more evidence than this alpha collects.
FailPassIncomplete
Read the before report · Read the after report
What the alpha checks
Educational guidance applies broadly. Automated coverage does not: these are the only checks released, and each reads specific inputs.
| Check | Required inputs | Supported syntax or environment | Status | Limitations |
|---|---|---|---|---|
NA-BUNDLE-01Recognizable secret indicators in client artifacts | Owner-selected client artifact directories (built files you ship) | UTF-8 text files. Patterns: sb_secret_, sk_live_/sk_test_, ghp_ prefixes and private-key headers. | Preview available in alpha 0.1.0 | Does not find unrecognized, encoded or transformed secrets. A match may be a synthetic value, not a live credential. |
NA-SOURCE-PUBLIC-01Public environment-variable names against an owner declaration | Owner-selected JS/TS source and a declared list of publishable names | Literal NEXT_PUBLIC_ identifiers (Next.js-style). Runtime versions not validated. | Preview available in alpha 0.1.0 | Does not validate values or the owner's decision. Dynamic access leaves the result incomplete. |
NA-CI-PIN-01Pinned GitHub Actions references | The selected GitHub Actions workflow directory | Line-oriented uses: declarations. Not a complete YAML parser. | Preview available in alpha 0.1.0 | Does not verify the referenced code or its dependencies. An actions.lock file makes the result inconclusive pending separate review. |
NA-CI-PERM-01Explicit default workflow token permissions | The selected GitHub Actions workflow directory | Limited top-level permissions: syntax. | Preview available in alpha 0.1.0 | Does not inspect job-level overrides, organization defaults or whether privileges are necessary. |