Delegation Cloud

AI App Release Rescue

A $299 review of what would block a release.

One repository. One application. One critical workflow. You get a structured report with findings and evidence. This is not a penetration test, and it is not a compliance certificate.

Request the $299 reviewSee a sample report

Checkout is prepared. Payment is not collected on this page.

Price, in the open

Separate from founding membership. The review is a one-time engagement. The sprint is optional and only after the report.

Review

$299

Fixed price. One repository, one web app, one workflow.

  • Thirty-two checks across twelve areas, each with a recorded outcome
  • Findings with evidence you can check in the repo
  • A report verdict: blocked, conditional, findings to track, or no blocking findings identified
  • Prepare-only. No writes to your repository.

Checkout is prepared and is not active on this page. When activated, the $299 review is charged when an engagement is created. Nothing is billed from this demo.

Request the $299 review

Optional sprint

$1,250

One-time. Only after the report. Only for eligible findings.

  • Work happens on a named branch, not main
  • You review and merge every pull request
  • No deployment, no production release
  • Does not create features outside the report

The $1,250 remediation sprint is charged only if you accept it after the report. That checkout is also not active here.

What you receive

  • A fixed rubric

    Thirty-two checks across twelve areas, covering security, release safety, AI-specific risk, accessibility, code quality, and documentation. Every check gets a recorded outcome and evidence, and a check we could not assess is reported as exactly that.

  • Findings you can check

    Every finding points at a file, config, runtime observation, or dependency report. Counts are computed, not self-reported.

  • A release verdict

    Blocked, conditional, findings to track, or no blocking findings identified. Derived from confirmed findings. The report does not say the application is ready to ship.

  • A customer-safe artifact

    No secret values. No executor identifiers. Readable HTML and structured JSON for the retention period.

How the engagement moves

Target is a draft within 48 hours of access granted. That is an operational target, not a contractual SLA.

  1. 01

    Request

    You name one repo, one web app, and one workflow. Payment checkout is prepared and is not collected on this page.

  2. 02

    Scope

    You confirm the boundary. Anything outside that repo, app, or workflow is out of scope.

  3. 03

    Read-only access

    You grant access separately. Do not paste tokens here. Reviewers never receive write access for the $299 review.

  4. 04

    Review

    An assigned operator records an outcome and evidence for every rubric check. Authority is prepare-only.

  5. 05

    Draft report

    Internal QA checks schema, secret redaction, and the limitations section. Then you see the draft.

  6. 06

    Close

    You accept or ask for clarification. Access is revoked. The optional sprint is a separate, later decision.

Data you should not send

We read

  • One repository, read-only
  • CI, lockfiles, and config templates in that repo
  • A public deployment URL, if you provide one, over ordinary HTTPS

We do not take

  • Access tokens, passwords, or API keys on this form
  • Production databases or live secret values
  • Other repositories, native apps, or cloud-account admin
  • Your code for model training or marketing

Audit checklist

Every check gets an outcome. A check we could not assess is reported, not quietly dropped.

  1. 01

    Secrets and credentials

    Committed credentials, keys reachable from the browser bundle, and whether secrets can be rotated.

  2. 02

    Authentication and session

    Whether the auth boundary is enforced in server code, session and token handling, and recovery flows.

  3. 03

    Authorization and tenancy

    Object-level authorization, whether the database refuses cross-tenant access, and role separation.

  4. 04

    AI boundary

    Whether model-visible content can grant authority, tool and action limits, output sinks, and cost ceilings.

  5. 05

    Data handling and retention

    What customer data the workflow stores, its retention and deletion path, and third-party egress.

  6. 06

    Input validation and abuse

    Schema validation at the request boundary and limits on endpoints that cost money or create records.

  7. 07

    Dependencies and supply chain

    Whether a dependency with a known advisory is reachable from the reviewed workflow.

  8. 08

    Release operations

    Production separation from preview and development, a tested rollback path, and shipped defaults.

  9. 09

    Observability and incident response

    Whether consequential actions leave an audit trail and whether logs or errors leak secrets or customer data.

  10. 10

    Accessibility

    Whether the reviewed workflow can be completed by keyboard, whether controls carry names and errors, and contrast and motion preferences.

  11. 11

    Code quality and tests

    Automated coverage of the critical workflow, how failures on that path are handled, and whether type and lint checks actually block a merge.

  12. 12

    Documentation and handover

    Whether a new engineer can run and verify the application, and whether known limits and the on-call path are written down.

What this is not

These limits appear on every report. They are not fine print we hope you skip.

Try the intake and a sample report without billing.

The demo uses synthetic data. It does not create a customer record, charge a card, or store a repository token.

Open the intakeDemo hub