Product 2.0 · pilot candidate

An acceptance report for every code handoff.

SecureFix runs the agreed checks on the delivered Go, Python or JavaScript repository and returns a signed PDF — findings, versions, hashes, verdict — that you attach to the acceptance file.

Built for DORA Art. 30(3)(e)(i) — evidence on ICT third-party deliverables.

SecureFix records what was checked, with which tools, what was found, and what was sealed for a concrete handoff in Go, Python, or JavaScript (including mixed). The buyer verifies pack integrity themselves. One line of category clarity: not an IDE scanner — an acceptance / audit-record pack for the handoff file.

The pilot was run with a client under NDA; the client and the findings are not disclosed. On a call we can walk through the methodology and a redacted sample report.

Request a pilot View sample PDF

Pilot pricing on request after scope review (language + repo bounds).

Also: sample Bundles, verify a Bundle, schema v1. Owner-run available: code stays with you. For a pilot you can wire a GitHub webhook so a pull request builds the same acceptance pack.

Languages: Go, Python, JavaScript (including mixed delivery). Public samples on this site are Go fixtures; Python/JS use the same Bundle schema. Product roadmap.

product · 2.0 go · python · js integrity · sha256 ai · scaffold only

$ securefix audit ./example-service
✔ fmt          passed
✔ vet          passed
✔ build        passed
✔ test         passed
⚠ gosec        findings recorded (demo)
✔ govulncheck  recorded

[•] Sealing Evidence Bundle…
↳ result.json + report.pdf · integrity hashes

✔ Bundle sealed — findings retained

Open sample PDF Sample Bundles

Demo sketch (Go terminal). A real Bundle uses the same seal format for a single-language scope or a mixed delivery (Go + Python + JavaScript in one pack).

Use cases

One product — three reasons to buy. DORA is one example below, not the homepage headline.

DORA · EU banks

Audit rights on paper → artifact at handoff

When you need to practically exercise monitoring / audit rights under DORA Art. 30(3)(e)(i) on a code delivery — with a portable artifact for the acceptance file.

SOC 2 · ISO 27001

Auditors want a portable evidence pack

For B2B SaaS and teams that need portable proof of software-delivery controls at audit time — without claiming SecureFix “grants” SOC 2 / ISO.

DevSecOps

Internal security review at handoff

When Engineering / AppSec accept code from a vendor or another team and want a sealed trail: scope, tools, findings, review — outside the other party’s CI.

Who usually buys

Not an abstract “compliance department” — roles accountable for passing audits or accepting a delivery.

Head of Compliance

Needs an artifact in the dossier

Close the gap “audit rights exist, but there is no portable record of the code handoff” — without buying another org certificate.

CISO

ICT / vendor oversight

See what was actually checked at handoff, with pack integrity — instead of trusting the vendor’s green tick.

Engineering Lead

Acceptance and security review

Agreed scope, recorded tool versions, and a review trail next to the acceptance act — for the team and for the auditor.

Team

Three founders — product, engineering, and finance. Operator-stage details: Legal.

Alexander

CEO, co-founder

20+ years in fibre-optic transmission networks at a regional grid operator: line engineer, then engineer (2nd category), responsible for acceptance and commissioning of optical links. Now runs product, pilots and partner delivery.

Eldar

CTO, co-founder

8 years in software development, including 4 years on Go. Owns the audit pipeline, architecture, and core engineering.

Gulnara

CFO, co-founder

Background in tax administration and corporate/public-sector finance (including Gazprom and the Ministry of Finance of Bashkortostan). Runs SecureFix financial model, compliance, and operations finance.

How it works

Scope

A bounded delivery in Go, Python, or JavaScript — or a mixed repo with multiple stacks in the operator contour (one sealed pack). Agreed handoff or Owner-run under your control.

Checks

Orchestrated stages with recorded tool versions by language (e.g. Go: gosec · govulncheck; Python: Bandit · pip-audit; JavaScript: eslint · npm-audit).

Sealed pack

PDF + machine-readable evidence with integrity checks — outside either party’s CI.

We already run scanners in CI — why SecureFix?

CI scanners (gosec, Bandit, eslint, npm-audit, etc.) produce findings inside your pipeline. SecureFix adds a portable acceptance pack for both sides at handoff: PDF + hash-checked Evidence Bundle, recorded tool versions, and operator review — without requiring the other party to trust your CI logs alone.

Typical CI scanner vs SecureFix

	CI scanner	SecureFix
Main output	Findings in the pipeline	Portable acceptance pack (PDF + Bundle)
Where it lives	Usually inside one CI	Can run outside either party’s CI
Integrity of the pack	Usually not packaged as a sealed handoff artifact	Hash-checked Evidence Bundle
Operator review	Optional / outside the tool	Designed into the acceptance record
Category	Findings in a pipeline	Acceptance / audit-record pack for handoff