Drydock
← Back to audit

You pay for the fix, not the finding

Start with a free audit. A Fix Pack adds a pull request for supported fixes and the full model review of authentication and security.

Audit

Free

Three audits a day per IP address. No account, no card, no sign-up.

Includes

  • Secrets committed in code or in a tracked .env
  • A .gitignore that does not cover secret-bearing files
  • Supported patterns for SQL injection, outbound URL risks, disabled TLS verification, unsafe deserialization and path traversal
  • Local access-check inconsistencies in Python/FastAPI routes and supported Supabase security patterns
  • Missing recognised test files, CI workflow or Dockerfile in the submitted source
  • A limited model security preview of selected code, when available

The preview has limited code coverage. Static results remain available if the preview is unavailable or incomplete, including when a usage limit is reached. The report shows which model analysis completed and any limits that affected it.

Does not include

  • The full model review of authentication and security included with Fix Pack
  • A pull request with fixes
Run an audit

Fix Pack

990 ₽

Per audit, paid once by card. Not a subscription — nothing recurs and nothing is stored to charge again.

You get a pull request containing

  • Each hardcoded secret the static rules detect, replaced with an environment variable reference
  • A list of every finding it does NOT change — including anything the deep review found, which is reported but not rewritten
  • A committed .env removed from version control, with every variable name preserved in .env.example
  • A .gitignore that covers .env files and key material
  • Per-provider instructions for rotating every secret that leaked, because deleting it from code does not make it safe
  • Your own test suite run against the change before the pull request opens

Plus the full model review

  • Findings with source references and verification limits
  • Broader model analysis of authentication and access rules in selected code
  • Broader model analysis of security risks, including injection in queries

Linked from the pull request, run against the same code. One review per Fix Pack — it is not a subscription. The report states its code coverage and limitations; a full review does not mean every file or vulnerability was covered.

Nothing is merged for you. The pull request sits there until you read the diff and decide.

Both audit scopes show findings and verification limits. Neither provides a validated readiness score out of 10, and no findings does not establish that the application is safe.

Before you can buy a Fix Pack

  • Run a free audit on a public GitHub repository. A Fix Pack opens a pull request, so there has to be a repository to open it against — an uploaded zip cannot be fixed.
  • Install the Drydock GitHub App on that repository, so we can push a branch and open the pull request.
  • The audit has to contain something we can actually fix. If it doesn't, checkout refuses rather than selling you a pull request with nothing in it.

Enterprise

Coming soon

For teams that want Drydock to own more of the path to production. These aren't live yet — no checkout, nothing to buy. Listed here so you know where we're headed.

  • Preview environments

    Spin up a disposable, running copy of a branch to see the fix work before it merges.

  • Deploy Pack

    Generated Dockerfile and CI workflow so the app is packaged to run on your own hosting.

  • SBOM & dependency scanning

    A software bill of materials plus alerts on known vulnerabilities in your dependencies.

Already bought something and lost your key? Recover it here.