Free for most builders. Fair for the rest.
No plans to pick and no sales calls. Your first app is free. Past that you pay per unit: $1 a month for each extra app, and a cap you set for anything else.
What's free, forever
- 1 app: unlimited scans, with watch (weekly or daily) and email alerts
- Unlimited code scans (CLI + MCP), including your local dev server
- AI agent tools and the agent rule
- Private report links
- What changed on every re-scan
- "This looks wrong?" feedback
- Checked-by-Shippable badge
Free forever means free forever. If this ever changes, existing free features stay free.
Per product, per unit
No plan grid. Each product has its own free allowance and its own price.
Apps
A live URL you own, saved to your account. Unlimited scans and weekly or daily watch (an email when something new leaks) are included. Fair use on the web: 30 scans a day per person, 50 a day per app.
Live: 1 app free, then $1 per extra app per month. Apps you had before this stay free.
Free every month1 appThen$1 / extra app / monthLiveCode scans
CLI and MCP, run on your machine, including your local dev server.
Free every monthUnlimitedThenFreeLiveAutomated checks
On every deploy, or from hosted CI. (Weekly or daily watch is not metered.)
Free every month500 checksThen$0.01/check or $0.005 after 10k checksComing soonAI Red Team
Ninja agents try to break your logins, checkout and inputs. One app, one full run, a report with proof. Billed from prepaid credit (top up from $20, each run uses $5). You set a spending cap before your first run.
Free every monthNoneThen$5 / runComing soonBusiness add-on
Client-ready PDF reports with your logo, 12-month history, teammates.
Free every monthNoneThen$19 / month flatComing soon
Extra apps are live at $1 a month each (unlimited scans and watch included); the other paid features are coming soon and nothing else is charged yet. Fair use: up to 30 website scans a day per person and 50 a day per app. The CLI and MCP have no limit.
What it costs in practice
1 app, unlimited scans and watch ($0)
5 apps, scanned and watched daily ($4 a month)
15 apps scanned and watched daily, 300 CI checks (within the free 500), Business, 2 Red Team runs
What would you pay?
Move the sliders. Patchy does the maths.
That's free. Go build something.
- Extra apps, scans and watch included (0)
- $0
- Billable checks (0)
- $0
- AI Red Team (0)
- $0
- Business add-on
- $0
- Total per month
- $0
Red Team is $5 per run, from prepaid credit (top up from $20). You set a spending cap before your first run.
Set a cap. Then sleep.
Every paid product has its own monthly cap, and you set it before your first paid run. The default is $0, so nothing is charged until you say so. We email you at 50%, 80% and 100%. Hit the cap and paid checks pause. Free ones keep running.
Questions
Do I need to talk to sales?
No. There's no sales team. Just three beavers in a coat, and they don't do calls.
Is the free tier a trial?
No. Your first app (unlimited scans and watch), the CLI and the AI agent tools are free forever, with no card. Each extra app is $1 a month, with unlimited scans and watch included.
Why is so much free?
Local scans run on your machine and outside scans are light reads, so they cost us very little. We charge where it costs us: AI agents and servers running on a schedule.
Can I get a surprise bill?
No. An extra app is $1 a month, shown before you pay, and you confirm every increase. The other paid features are not live yet. When they are, every paid product has its own cap, you set it before your first paid run, and it starts at $0.
What counts as a check?
One automated scan of one app that we run for you, on a deploy or from hosted CI. Scans you start yourself and weekly or daily watch never count; they come with your apps.
What is the AI Red Team?
AI agents that actively try to break your logins, checkout and inputs, scoped from your scan, only on apps you've proven are yours. One run is one app, tested end to end. It is $5 per run, paid only, with no free run, billed from prepaid credit: top up from $20 and each run uses $5. You set a spending cap before your first run.
Do you see my code?
Code scans run on your machine. Only package names and versions go to the OSV vulnerability database. Report links keep findings after the #, which never reaches our server. Each scan sends an anonymous count (never URLs, code or findings), which you can turn off with SHIPPABLE_TELEMETRY=0.
When can I pay?
Extra apps are live now: $1 a month each, from the page of a scan that needs one. The other paid features aren't live yet. Join the list below and we'll tell you once, when they are.
