Wire Cipherwake into your AI-coder workflow in 60 seconds.

Cipherwake compares your preview deploy against production and shows what changed on the public internet — third-party scripts, security headers, TLS, certs, SPKI, and trust posture — before you ship. Pick the surface that fits your workflow. Free tier covers all of them.

GitHub Action — the recommended starting point

If you have a GitHub repo and care about your domain's trust posture, this is the highest-leverage place to start. Cipherwake comments inline on every PR when cert / SPKI / HSTS / CSP / DMARC / vendor scripts drift since your baseline.

Paste a domain above to generate your workflow.

npx pqcheck onboard your-domain.com

1. Scaffold the workflow

   npx pqcheck init

   Interactive prompts ask for your domain, fail-on severity, and baseline. Writes .github/workflows/cipherwake.yml ready to commit. (Or use npx pqcheck onboard your-domain.com above to do everything at once.)

2. Commit the workflow + push

   That's it for the free tier. The generated workflow calls the public API anonymously — no API key, no repo secrets, no extra setup. Cipherwake will comment inline on every PR when your domain's posture drifts.

3. Optional — higher CI limits or saved baselines Founder Pro $19.99 / mo

   Founder Pro (launch pricing locked while subscription active; $29/mo standard post-traction) unlocks 5,000 Trust Diff calls/month, saved CI baselines, the approved-vendor allowlist, custom fail-on thresholds, and webhook delivery (Slack incoming-webhook URLs work for inline-in-channel alerts). Generate an API key at /account#api-keys and add it as a GitHub repo secret called CIPHERWAKE_API_KEY. The workflow already references it conditionally — no edits needed.

4. Commit and push

   git add .github/workflows/cipherwake.yml
   git commit -m "ci: add Cipherwake Trust Diff gate"
   git push

   Open a PR. Cipherwake comments inline within ~60 seconds of the workflow firing.

Preview Deploy Trust Diff NEW

The PR-time variant: compare a Vercel/Netlify preview deployment URL against production and surface new third-party scripts, header regressions, and DBR score drops right inside the PR review — before merge.

name: Preview Trust Diff
on: pull_request
permissions:
  contents: read
  id-token: write       # Free=100 calls/repo/mo via OIDC, no API key needed
  pull-requests: write

jobs:
  preview-diff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - id: vercel
        uses: amondnet/vercel-action@v25
        with:
          vercel-token: ${{ secrets.VERCEL_TOKEN }}
          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
      - uses: cipherwakelabs/pqcheck@v4
        with:
          mode: preview-diff
          preview-url: ${{ steps.vercel.outputs.preview-url }}
          production-url: https://your-domain.com
          comment-on-pr: true

The PR comment looks like this:

### 🟡 Cipherwake Preview Trust Diff — Review recommended

**Compared:**
- Preview: `https://feature-x-abc123.vercel.app`
- Production: `https://your-domain.com`

**Application surface:**
- + New third-party script: widget.intercom.io
- - Content-Security-Policy removed (was: <set>)
- ~ DBR: 7.2 → 6.8 (worse by 0.4)

**Transport (informational):**
- Preview TLS is served by an edge provider (`Let's Encrypt`).
- Transport posture differs because hosts differ — not a CI-failing condition by default.

**Policy:** Report-only · max severity `high` · tier `free`

_CI fail rules, custom thresholds, and approved-vendor allowlists unlock on Founder Pro._

Run it locally too:

npx pqcheck preview-diff \
  --preview https://feature-x-abc123.vercel.app \
  --production https://your-domain.com

Free tier: 100 calls/repo/month report-only. Founder Pro $19.99/mo (launch pricing, locked while sub active) unlocks CI fail rules + approved-vendor allowlist + custom thresholds. See the methodology page for the diff logic, severity model, and what it does NOT claim.

CLI — npx pqcheck

The CLI is zero-install. No account needed for one-shot scans.

One-shot scan

npx pqcheck stripe.com

Three gates, one command

From v0.16.24 onwards, pqcheck deploy-check --ai emits three related decisions in the structured AI guard block:

• ship_decision — the headline routing field your AI coder reads. Folds in drift + route_assertions by default; --strict-posture adds the posture gate too. pass means everything held; block means something regressed in this deploy that needs to be looked at before announcing.
• ship_decision_drift — drift-based: did the public trust surface change since the baseline (new third-party script, removed HSTS, cert/SPKI rotation, etc.). A site that's been imperfect for months but hasn't regressed today gets pass here — gating on standing properties is cry-wolf by construction.
• ship_decision_assertions — verifies your declared private routes are still gated. Declare them in .cipherwake.json at your repo root and Cipherwake asserts /api/admin/*, /api/internal/*, etc. still return 401/redirect on every deploy. The catastrophic case — a middleware change that flips /api/admin from 401 to 200 — blocks the deploy automatically. This is the gate that fires on backend/admin-heavy deploys where the public landing page doesn't change. Methodology →
• posture_decision + posture_grade — absolute HTTP header posture, graded A+ → F (strict SSL-Labs-style rubric over CSP / HSTS / X-Frame-Options / X-Content-Type-Options / Referrer-Policy / Permissions-Policy + info-leak headers). Always emitted. Advisory by default, not gating. If your site grades D, you'll see a one-line advisory + a CIPHERWAKE_POSTURE_FIXES block with ready-to-paste fix snippets (Next.js consolidated headers(), vercel.json, Express helmet) — but your deploy won't be blocked just because the standing posture is imperfect.

Declare your private routes — .cipherwake.json

Drop a file named .cipherwake.json at the root of your repo (we walk up to 5 directories to find it):

{
  "routeAssertions": {
    "assertions": [
      { "path": "/api/admin/users",   "expect": "protected", "why": "Admin user mgmt API" },
      { "path": "/api/admin/exports", "expect": "protected", "why": "Bulk data export" },
      { "path": "/api/internal/cron", "expect": "protected", "why": "Internal cron handler" },
      { "path": "/api/public/health", "expect": "exposed",   "why": "Public health endpoint" }
    ]
  }
}

Cipherwake adds your declared routes on top of a baseline of universally-private paths (/admin, /account, /dashboard, /api/admin, …) and auto-detected paths inferred from your robots.txt Disallow rules and homepage. No credentials required — Cipherwake probes from the public internet without auth, asserts each route's status code, and folds critical failures into ship_decision. See why we don't crawl behind your login for the design decision.

The lock-in flag — --strict-posture (or short --strict)

Once your site reaches A or B posture and you want to prevent backsliding, opt into the hard gate:

# Default: drift gate, posture advisory. Right for most sites.
npx pqcheck deploy-check yourdomain.com --ai

# Strict: drift gate + posture gate (worst-of-both).
# Recommended after your site reaches A/B posture.
npx pqcheck deploy-check yourdomain.com --ai --strict-posture

With --strict-posture, ship_decision becomes worst-of(drift, posture). D/F posture promotes a clean-drift pass to block. The two inputs stay exposed as ship_decision_drift / ship_decision_posture so any AI coder reading the block can route on the underlying signals directly.

See /methodology/posture-grading for the full rubric + threshold ladder, and /methodology/ai-coder-protocol for the pasteable AI Coder Protocol rule.

The full subcommand list

• pqcheck <domain> — full Decryption Blast Radius scan + posture grade
• pqcheck onboard <domain> — one-command setup wizard (scan + init + vendors + checklist + browser)
• pqcheck init — scaffold the GitHub Action workflow (interactive)
• pqcheck trust-diff <domain> — regression check vs baseline
• pqcheck deploy-check <domain> — pre-deploy gate (Trust Diff with last-scan baseline + posture advisory)
• pqcheck deps <domain> — third-party origin audit
• pqcheck lock <domain> — committable QXM manifest
• pqcheck vendors export <domain> — write cipherwake.vendors.json (vendor lockfile)
• pqcheck vendors check <domain> — CI gate; fails on new vendor origins
• pqcheck release-checklist <domain> — markdown checklist for release notes
• pqcheck cert <file.pem> — offline cert analysis
• pqcheck guard --domain <domain> -- <deploy-cmd> — wrap your deploy command; runs the deploy-check gate right after the deploy finishes
• pqcheck last [domain] — reuse a recent gate verdict (local state or your repo's latest GitHub Actions run) instead of re-scanning

New in v0.17 — and how releases reach you

New gate behavior ships to pqcheck@beta first and is promoted to @latest only after our release gate is green (typecheck, full test suite, CLI smoke, live deploy-check against cipherwake.io). v0.17.0 — the first release on this gated stable track — adds: pqcheck last (reuse a recent verdict instead of re-scanning), setup/init remembering your domain in .cipherwake.json so deploy-check/guard run with no arguments, flake context in the AI guard block (flake_hint=first_failure|recurring|frequently_failing|previously_dismissed from local check history), and a hardened exit-code contract — an internal CLI error now exits 3 instead of masquerading as a security block.

Full docs: npmjs.com/package/pqcheck · github.com/cipherwakelabs/pqcheck

Browser extension

Toolbar badge with live grade for every HTTPS site you visit. No account needed. Cipherwake never reads page content, cookies, or form data. Available on Chrome.

What you get on Free

• Unlimited public scans via the CLI, extension, and web
• 1 monitored domain with daily checks + email alerts
• Weekly Cipherwake Changelog email (Mondays)
• 100 Trust Diff API calls / month per repo for CI gating
• Trust Diff + Vendor Change alerts in your dashboard
• Full methodology on every scoring component (no opaque black-box)

Need more? See pricing — Founder Pro $19.99/mo (launch pricing) unlocks 5 monitored domains + the approved-vendor allowlist + 5,000 Trust Diff calls/mo + custom CI thresholds + webhook delivery (Slack incoming-webhook URLs work).

Where to go next

• Methodology library — what we measure, how, and what we don't claim
• Public API docs — build with the same scanner
• Vendor lockfile methodology — track third-party scripts as a committed artifact
• cipherwakelabs/pqcheck — public source repo (CLI + Action)