Find the vulnerabilities an attacker can reach, with proof and a fix

SHIP reviews your code for vulnerabilities and tries each finding on a live preview before it reports it. Each confirmed finding comes back with proof and a pull request that fixes it.

For: Engineering teams without a dedicated security engineer.
Instead of: A scanner report full of findings nobody has time to check.

Runs today: Run a security review on one pull request with ship delegate pr --prompt-file, or schedule the security advisory triage automation.

Join the early-access list Read how to add review instructions

Answer 4 questions. SHIP emails you when it opens to you.

Terminal

$ ship delegate pr SHIP-412 --prompt-file security-review.md

Runs today: a security review of one pull request, with the instructions you write in security-review.md. A security review on every pull request is in early access.

How it works

Review, prove, then fix

Step 1

Tell the reviewer what to check

Add a security review to every pull request, or run it across the whole repository on a schedule. Write what it checks in plain words, from auth and injection to rules specific to your codebase.

Step 2

Prove each finding before it reaches you

The Tester tries each finding against a preview deployment of your app. A finding it can't reproduce is marked unconfirmed instead of reported.

Step 3

Get the fix as a pull request

A Builder writes the patch for each confirmed finding. Your CI, a code review and the same exploit attempt run again before the pull request is ready.

Capabilities

Control where the review runs and what it costs

Check advisories against your code

The security advisory triage automation runs your package manager's audit. It checks whether your code reaches each advisory's vulnerable code, and patches the ones it reaches.

Run the review on a different model from the author

Pick the harness and model for the security review, so a second model reviews what the first one wrote.

Paste in your scanner's findings

Paste a scanner's findings into an issue and assign it to SHIP. The agents fix them in a tested pull request.

Keep provider keys out of the sandbox

Agents run in isolated sandboxes with short-lived, scoped tokens. Your provider keys never enter them.

See what each review cost

Every review reports how long it took and what it cost, priced on the model that actually answered.

Comparison

Compare SHIP with Devin for Security

What each product's own pages say. Last reviewed October 2, 2026. Check the vendor's page before you buy.
Devin	Describes Devin for Security as an agent that finds vulnerabilities, checks that each one is exploitable at runtime, and opens fix pull requests. Devin for Security Reproduces exploits in isolated sandboxes before it reports findings to teams. Devin for Security Lets teams use their own scanner and connect the tools they already have through its API. Devin for Security
SHIP	In early access Tries each finding on a preview of your app that your own pipeline deploys. Runs the security review on the harness and model you choose, on your own keys. Generally available Bills per mission: one credit covers one mission of up to 3 agent-hours, and your own provider bills model usage. Key facts

FAQ

Frequently asked questions

Is SHIP's security review available today?

Partly. A security review on every pull request, with each finding proven on a preview, is in early access. Today you can run a security review on one pull request with ship delegate pr --prompt-file, or schedule the security advisory triage automation.

Add review instructions

Does SHIP replace a penetration test or an audit?

No. SHIP catches and fixes what a code review and a live preview can show. Keep the penetration tests and audits your customers and certifications require.

Can a fix change my CI configuration?

No, unless a person asked for it. A change under .github/workflows is blocked before it is pushed, and every fix still has to pass your CI and a code review.

When is Devin the better fit?

Devin fits a team that wants a dedicated security agent available today, as Devin's own page describes. It runs many investigation agents in parallel across the codebase and works with the scanners the team already has. SHIP fits when security review should run in the same loop as your other pull requests, on the harness and model you choose.

Start a security review on your next pull request

Join early access and decide what the security review checks.

Join the early-access list

Answer 4 questions. SHIP emails you when it opens to you.