Mission
Be the named check on the pull request: a commit-bound SHIP or NO_SHIP with the gate, the finding, and the hash. UNVERIFIED when it cannot answer. Never a false green.
Loading ShipGate
ShipGateGreen CI is not a release decision. ShipGate is the check branch protection can require, and the certificate InfoSec can file.
Be the named check on the pull request: a commit-bound SHIP or NO_SHIP with the gate, the finding, and the hash. UNVERIFIED when it cannot answer. Never a false green.
ShipGate is merge-time release authority, not a compiler and not an AppSec platform. Advisory scans return CLEAR, BLOCKED, or UNVERIFIED. SHIP is reserved for the signed, commit-bound pipeline.
Continuous CI is hosted. The GitHub App fetches one commit onto WholeStack infrastructure, runs the gates, and deletes the checkout. The free web scan is the same trade without a pull request. VPC or dedicated deployment is an Enterprise contract, not a checkbox.
Security reviews, questionnaires, and procurement go through the intake desk — not a donor GitHub org and not a mailto form pretending to be a product.