A secure development standard for software built with AI coding tools
Hullproof gives your AI coding tool the security rules to follow while it builds, a checklist to review the result, and a release gate that shows what is still open before you ship.
16.50 USD, taxes included. One time purchase. Delivered as a zip.
The first 500 buyers get 25% off with the code FIRST500.
AI tools build fast and skip the parts nobody asked for
AI coding tools write working software quickly. They also skip the parts that are easy to forget, such as who may read a row, what happens when a payment webhook is sent twice, and where a key ends up. Those gaps are easy to miss in review and costly to find after launch.
Hullproof turns those parts into written requirements that your tool can follow and that you can check.
Three parts that work together
A written standard
Requirements with IDs, a severity and a source for each, grouped by area such as authentication, APIs, databases, AI features, infrastructure and privacy. Every requirement says what to do and how to check it.
Instructions for your AI tool
Rule files and an installer for fifteen AI tools, so the tool follows the standard while it writes code.
A release gate
A read only audit that reviews your own project, writes a report, and ends with a clear verdict: not ready, ready with accepted risk, or ready.
From download to a release verdict
- Download the kit and copy it into your project.
- Run the installer for your AI tool. It shows what it would change first.
- Build as usual. The rules are in place for your tool.
- Before a release, run the audit. It reads your project and writes a report.
- Fix what the report lists, run it again, and decide with the verdict in front of you.
Fifteen AI tools, in the app, the terminal or VS Code
Hullproof runs in the tool you already use. Seven tools can hold the audit to read only through hooks or settings, with limits such as trusting the project folder first. The other eight take the rules and the audit prompt as advice only. Each tool has its own page in the kit that says which applies.
Can enforce a read only audit (with limits)
- Claude Code
- Codex
- Antigravity
- Gemini CLI
- Cursor
- Windsurf
- GitHub Copilot
Rules and prompts as advice
- Lovable
- Replit
- Bolt
- Emergent
- v0
- ChatGPT
- Claude.ai
- Gemini app
Start free. Add Pro when you need the rest.
| Area | Free | Pro |
|---|---|---|
| Requirements | Every BLOCKER and CRITICAL requirement, 110 in all | All 655 requirements, adding every HIGH, MEDIUM and LOW |
| Release audit | A pre launch checklist run in your AI tool | A full audit with evidence and an independent verification step |
| API review | The API requirements that are BLOCKER or CRITICAL | A review of your endpoints against the whole API standard |
| Threat model | A template you fill in | A threat model built with you from your repository |
| Agents | A read only pre launch auditor | Further agents that review, hunt, check coverage and try to disprove findings |
| CI and tooling | Not included | A machine readable requirements file and a CI gate example |
| AI tool files | Rules, prompts and installer for fifteen tools, scoped to the free requirements | The same tools with the full requirement set and the full audit prompt |
| Templates and checklists | Audit report, stage record, accepted risk, threat model, breach runbook | The same, plus incident, ownership, inventory and policy templates and further checklists |
| Price | Free, open source | 16.50 USD, one time |
Requirements
- Free
- Every BLOCKER and CRITICAL requirement, 110 in all
- Pro
- All 655 requirements, adding every HIGH, MEDIUM and LOW
Release audit
- Free
- A pre launch checklist run in your AI tool
- Pro
- A full audit with evidence and an independent verification step
API review
- Free
- The API requirements that are BLOCKER or CRITICAL
- Pro
- A review of your endpoints against the whole API standard
Threat model
- Free
- A template you fill in
- Pro
- A threat model built with you from your repository
Agents
- Free
- A read only pre launch auditor
- Pro
- Further agents that review, hunt, check coverage and try to disprove findings
CI and tooling
- Free
- Not included
- Pro
- A machine readable requirements file and a CI gate example
AI tool files
- Free
- Rules, prompts and installer for fifteen tools, scoped to the free requirements
- Pro
- The same tools with the full requirement set and the full audit prompt
Templates and checklists
- Free
- Audit report, stage record, accepted risk, threat model, breach runbook
- Pro
- The same, plus incident, ownership, inventory and policy templates and further checklists
Price
- Free
- Free, open source
- Pro
- 16.50 USD, one time
See what an audit looks like
The free edition is public, so you can read everything it contains. A sample audit report shows the format, and a small deliberately vulnerable demo app lets you run an audit on something safe.
Honest limits
- It does not make an app secure, and it does not certify compliance. It checks your project against a written standard and tells you what it finds.
- It reviews code and files. Some checks need a dashboard export or a live test, and the report marks those instead of guessing.
- It does not replace a penetration test, a review by people, or legal advice.
- Outside the seven tools that can hold the audit to read only, the rules are advice. Keep code review, secret scanning and your release gate in place.
- Running an audit uses your AI tool, so cost and results depend on the model and the size of your project. A more capable model gives better reviews.
- It contains no exploit code and no attack tools. The audit reviews your own project.
Licence and terms
The free edition uses Apache 2.0 for code and CC BY SA 4.0 for documentation. Hullproof Pro is licensed to a person, or to a company and its employees and contractors, for use on their own projects and on client projects they build or review. The files may not be redistributed, resold or placed in a public repository. Updates released to you are covered. All sales are final once the files are delivered, subject to the checkout provider's rules and applicable law. The full licence is inside the zip.
Questions
Do I need Claude Code?
No. Hullproof has a folder for fifteen AI tools. The installer places the right files for the one you use.
Does Hullproof send my code anywhere?
Hullproof is a set of files. An audit runs inside your AI tool, so your code goes wherever that tool sends it, under that tool's terms. Hullproof adds no service of its own.
Will it make my app secure?
No tool can promise that. Hullproof gives your AI tool clear rules and gives you a report and a verdict, so you know what is open before you release.
Can my team use it?
A company purchase covers the company's employees and contractors. A personal purchase covers one person.
How do updates arrive?
We replace the file in your customer portal, and the update is covered by your licence.
What if I want a refund?
Sales are final once the files are delivered, subject to the checkout provider's rules and applicable law. Read the free edition first to see what you are buying.
Where do I get help?
Open an issue on the free repository on GitHub.
Start with the free edition
Read it, try it on the demo app, then add Pro when you want the rest.
The first 500 buyers get 25% off with the code FIRST500.
Sold by Rare Phronesis Limited. Digital download.