ShipSure
Sign in

Changelog

What shipped, and when. Every entry describes something you can check against the running product.

v0.3.1Added2026-08-18

Per-test detail beyond vitest, and a Homebrew tap

  • Projects using `node --test`, `tap` or mocha with the TAP reporter now get individual test names, statuses, durations and the assertion message on failures — the same detail vitest projects have always had. Nothing to configure; ShipSure reads the output the runner already prints.
  • The first attempt at this parsed TAP only, on the documented behaviour that Node switches to TAP when its output is piped. Current Node does not — it emits its spec reporter through a pipe too, so the feature parsed nothing for the runner it was mainly built for. Running the real CLI against a real project is what caught it. Both formats are handled now.
  • A Homebrew formula, depending on node rather than bundling a runtime, plus a release script that reads the version and checksum from the published npm tarball so a formula can never point at a hash that does not match what the registry serves.
  • The annual plan is described as two months free, which is what ten months’ price for twelve months of service is. There is still no free trial and no free tier — the Terms say so in the same words.
  • winget is still not shipped, and the reason is written down rather than left as a to-do: it cannot install an npm package, and doing it properly needs a signed 110 MB standalone binary.
v0.3.0Added2026-08-17

Watch mode, rollback, GitHub, Slack, SSO and private runners

  • `shipsure watch` verifies whenever the tree goes quiet. One run at a time, and a burst of edits collapses into a single verification rather than forty.
  • `shipsure rollback` restores the tree to the baseline after a bad run. It stashes your current state first — including untracked files, which is where an agent puts most of its output — and refuses outright if a commit has landed since.
  • GitHub commit statuses, with an optional pull-request comment. A fine-grained token with commit-status write is all it needs, and the token is checked against GitHub before it is stored.
  • Slack, via an incoming webhook. Defaults to failed and blocked runs, because a bot that posts on every green build gets muted.
  • Sign in with GitHub. It signs you in but never signs you up, and never auto-links on a matching email address — that is the classic account-takeover route.
  • Private runners, for code that cannot leave your hardware. The runner polls outward over HTTPS, so nothing connects inbound; each job gets a fresh clone that is deleted afterwards; two runners can never claim the same job; and a runner killed mid-job releases its lease so the work requeues.
  • A runner baselines against the parent commit, so its verdict answers whether this commit broke something rather than whether the checks happen to pass. Results upload through the same endpoint every other client uses — the server cross-check caught a real bug in the first version of this, where a baseline taken from the same clone made a failing test look pre-existing.
  • A favicon, an Apple touch icon and an Open Graph card, all generated from the same two paths as the wordmark so the tab icon and the logo cannot drift apart.
  • Integration credentials are encrypted at rest with AES-GCM under a Worker secret, and are never returned by the API once saved.
v0.2.0Added2026-08-17

API keys, webhooks, approvals, insights and sharing

  • API keys for scripts and CI, with read and write scopes. A key can create and read runs; it can never invite a member, mint another key, or read the audit trail — the blast radius of one leaking stops well short of the account.
  • Outbound webhooks, HMAC-SHA256 signed with the timestamp inside the signature so a captured request cannot be replayed. Six retries over two hours, a delivery log with response codes, one-click replay, and secret rotation. Endpoints pointed at private or link-local addresses are refused.
  • Approval gates. A blocked run used to be a dead end whose only escape was re-running until the verdict changed. Now it opens a gate somebody decides on the record, with a reason required on rejection.
  • Insights: pass rate, runs per day by verdict, what fails most, per-project and per-machine breakdowns, and median/p90 run duration. Runs where the CLI disagreed with the server are surfaced rather than buried.
  • Run comparison against the previous run — fixed, newly broken, still failing, and checks that disappeared. A deleted test cannot fail, and that is not the same as passing.
  • Share links: a read-only public page for one run, expiring and revocable, for showing a client the evidence without giving them an account. Plus Markdown and JSON export of any run.
  • Notes on runs, evidence download, and search, filters and saved views on the runs list — filtered in the database, so a search cannot miss something sitting on page four.
  • A notification bell with per-kind email preferences, an append-only activity log with CSV export, session management, organization rename, full data export and organization deletion.
v0.1.5Added2026-08-17

Team invitations and password reset

  • Invite people to your organization from Settings → Team. They get a link that works once and expires in seven days, and they join the seat your plan already pays for — an invited teammate does not buy their own subscription.
  • Seats are counted honestly. A pending invitation holds a seat until it is accepted or revoked, so the number on the Team page is the number you are actually using. The limit is enforced when the invitation is sent and again when it is accepted, because a plan can be downgraded in between.
  • Roles can be changed and members removed from the same screen. An organization can never be left without an owner: the last one cannot be demoted or removed.
  • Password reset. A locked-out account previously had no recovery path at all. Reset links are single-use, expire in an hour, and requesting a new one immediately retires the old — so if somebody else triggered a reset on your account, asking for your own kills their link.
  • Completing a reset signs you out on every device. A reset is what you do when you think your account is compromised, and leaving the other sessions alive would defeat the point.
  • Passwords can also be changed from Settings without leaving the app. The current password is required even though you are already signed in, so a borrowed unlocked laptop is not enough to lock you out of your own account.
v0.1.4Security2026-08-17

Rate limiting and security headers

  • Login is limited to 10 attempts per minute per address. An audit found ten wrong passwords in a row all answered normally, which is a brute-force path against real accounts.
  • Signup and the anonymous checkout endpoint are limited too. Both reach PayPal, and an unbounded endpoint that spends someone else’s quota on our credentials is how a merchant account gets suspended.
  • The web app now sends a Content-Security-Policy, X-Frame-Options, HSTS, Referrer-Policy and Permissions-Policy. It previously sent none, which left the dashboard framable — clickjacking a “revoke machine” button is a real attack, not a theoretical one.
  • Removed the x-powered-by header that named the framework and its version to any scanner.
  • Docs, Changelog, Privacy and Status pages added. Status performs a real check from your browser rather than showing a hand-set banner.
v0.1.3Changed2026-08-16

Checkout requires a plan, and there is no trial

  • An account can no longer exist without a plan and a card. The card is vaulted and charged before any row is written, so a declined card leaves nothing behind — previously a failed checkout left a dead account that could not do anything.
  • The 3-day trial is gone. Every plan is paid from the first day; the annual rate is simply lower, and is no longer described as “two months free”.
  • Uploading a run is now idempotent on its correlation id. A CLI retrying after a network timeout used to hit a unique index and receive a 500 for a run that had actually been saved.
  • Malformed requests return 400 with the offending fields named. They previously fell through to a generic 500 on every endpoint.
v0.1.2Fixed2026-08-16

Verification works on projects that are not vitest

  • The vitest adapter claimed any project with a test script, then failed to resolve a binary that was never installed — so repositories using node --test, mocha, ava or bun were permanently INCONCLUSIVE. They now run through a generic adapter that executes the project’s own test command.
  • `shipsure init --force` no longer unlinks the project. Re-running it silently cleared the project id, and the next verify stopped uploading with no indication why.
  • `shipsure doctor` reports the command each check will run instead of printing the Windows shell banner next to every line.
v0.1.1Added2026-08-16

CLI authentication and the run record

  • Device-code login: `shipsure login` prints a code you approve in the browser. No password is ever typed into a terminal.
  • Agent tokens are short-lived and rotate on refresh. Reusing a retired refresh token fails, which is the tripwire for a credentials file copied off a laptop.
  • `shipsure logout` revokes server-side, not just locally.
  • Runs upload to the dashboard with their full check evidence. The server recomputes the verdict from the uploaded checks, so a client claiming “verified” while carrying a failing check is recorded as failed and flagged.
  • Dunning: a declined renewal is retried across a week before access ends, instead of stranding the organization on the first failure.
v0.1.0Added2026-08-15

First working end to end

  • Verification engine: tests, build, typecheck, lint, scope, dependencies, regression and policy.
  • Baseline capture and regression detection against the state before the agent ran.
  • Accounts, organizations and role-based access on Cloudflare Workers and D1.
  • PayPal billing with card-on-file and an hourly renewal sweep.

ShipSure is early. Things listed under Not built yet in the docs are genuinely not built, and this page will say so when they are.