ShipItWorks

Other apps

Seven other apps, each scored on the same own rubric of ours. None of them is on Google Play yet.

Google Play asks new developer accounts to run a closed test with at least 12 testers for 14 days in a row before an app can go to production. Our Android apps have not done that test yet, so none is on Google Play today.

What we promised, and what we have not finished. We promised one public rubric for every product, a list of what is not finished on every page, and a named source for every number. Most of these products are not finished, and each page says where it stops. Read the rubric or every claim and its source.

HomeIoT Guardian

Audit home Wi-Fi security, discover smart devices, harden your connected home.

Scorecard

66/ 100

Stage: Beta on our own rubric. Google Play: Not on Play.

Primary journey: not shown

Scored 2026-11-08 on our own rubric; repository at commit 88fea44.

Google Play: Not on Play

HomeIoT Guardian demo · 2:55Captions · Transcript

Recorded 2026-11-01. The narration says you can export a PDF report; PDF export has not been run on a device yet. Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.

Watch the HomeIoT Guardian demo video on its own page, with its transcript

Email us about HomeIoT Guardian

This button opens your email app with the subject already filled in. Your message comes to support@shipitworks.com. There is no form and no database. Privacy notice.

Works today

Each line links to the scorecard row that backs it.

Not finished

From the same scorecard, next to the claims.

  1. No feature has a proof log on main: five are built and tested with sample data on a desktop JVM, one (PDF export) is not tested yet
  2. Not run on a phone or a real home network: the mDNS/SSDP scan, the router port check, the PDF render and the notification prompt
  3. The PDF export attempt on the JVM failed (4 of 4 tests, 2026-11-07); it needs a device or an instrumented test
  4. README links proof/unit-tests.log, proof/catalog-counts.log and proof/upnp-fetch-http.log; none of the three is on main
  5. 12x14 closed test not started per repo docs; no signed .aab built here (no upload key on this machine)
  6. No CHANGELOG and no LICENSE file on main; no user guide beyond the release docs; lintDebug exit 1 on a ByteOrderMark false positive was reported earlier and not re-run
  7. TalkBack, contrast and large-font checks not run; no reduced-motion setting in the app
  8. Network use not yet traced (no network capture); cleartext traffic is permitted in the base network config

ScamShield Companion

Offline-first scam-safety app built around Prevent, Protect, Recover; built so analysis runs on the device (offline use not yet tested).

Scorecard

65/ 100

Stage: Beta on our own rubric. Google Play: Not on Play.

Primary journey: shown with sample data

Scored 2026-11-08 on our own rubric; repository at commit ff87049.

Google Play: Not on Play

ScamShield Companion demo · 2:54Captions · Transcript

Recorded 2026-11-01. The narration says nothing leaves the device and the header on screen says the app is offline and private. Corrected 2026-11-07: that is not verified. No network capture of the Android app has been run; offline use was run once in the web build with Chrome's emulated offline mode (2026-11-08). Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.

Watch the ScamShield Companion demo video on its own page, with its transcript

Email us about ScamShield Companion

This button opens your email app with the subject already filled in. Your message comes to support@shipitworks.com. There is no form and no database. Privacy notice.

Works today

Each line links to the scorecard row that backs it.

Not finished

From the same scorecard, next to the claims.

  1. No signed release .aab; a debug APK was built once (permissions dump only) and no release build has run
  2. The QR scanner and the Android share sheet were not run; text recognition (OCR) ran once on one synthetic screenshot and its auto-found boxes were not checked; the redacted-PNG check covers one hand-drawn box in the web build; the money playbook is unit-tested only, its UI not run
  3. Play listing copy, screenshots and the data-safety form are still missing
  4. No dark mode; contrast, keyboard and TalkBack not checked; comfort text was measured only at an emulated 320px width, not on a phone
  5. Offline was run once in the web build with Chrome's emulated offline mode (four tabs and one message analysis); offline OCR, airplane mode on a device and the Android app were not run
  6. No network capture of the Android app on a device: "nothing leaves the device" is not yet traced (web build walk and debug-APK manifest only)
  7. The PausePay and Phish or Legit advice, card labels and the Massachusetts crypto-kiosk figure on the STOP screen have no expert review or source check on main; money-playbook step wording not checked against FTC or issuer pages
  8. Privacy policy contact is still the placeholder [YOUR CONTACT EMAIL] (PRIVACY_POLICY.md:71)

AI Value

Model AI ROI, P&L margins, Balance Sheet cash flow & 30-day adoption pilots.

Scorecard

68/ 100

Stage: Beta on our own rubric. Google Play: Not on Play.

Primary journey: not shown

Scored 2026-11-08 on our own rubric; repository at commit 497c725.

Google Play: Not on Play

AI Value demo · 3:08Captions · Transcript

Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.

Watch the AI Value demo video on its own page, with its transcript

Email us about AI Value

This button opens your email app with the subject already filled in. Your message comes to support@shipitworks.com. There is no form and no database. Privacy notice.

Works today

Each line links to the scorecard row that backs it.

Not finished

From the same scorecard, next to the claims.

  1. Executive PDF export: built, not tested yet. No run log on main; the instrumented test needs a device and a fresh installDebugAndroidTest, and the device check in HANDOFF.md has no saved log. The multi-page fix is on an unmerged PR
  2. UI screens: not tested yet; no instrumented or UI run, no tracked screenshots
  3. Privacy: no permissions declared in the debug APK and no analytics library by name in release dependencies (2026-11-07 logs); no network capture, so runtime behaviour is not yet traced. README line 3 'runs entirely on the phone' is not yet traced either (fix PR #23 open)
  4. No signed release build and assembleRelease not run; the existing release APK is debug-key signed, so it cannot go to Play
  5. No user guide, no LICENSE, no CHANGELOG file; root still holds ~20 stray chat-dump files and wrong-path duplicate catalog JSONs

PocketSec

Find out how hackable you are. The scan runs in your browser; what leaves the device is not yet traced (the password check sends a 5-character hash prefix to Have I Been Pwned).

Scorecard

56/ 100

Stage: Alpha on our own rubric. Google Play: No Android app.

Primary journey: shown with sample data

Scored 2026-11-08 on our own rubric; repository at commit af82be6.

Google Play: No Android app

PocketSec demo · 1:56Captions · Transcript

Recorded 2026-11-08 on the demo profile. The scorecard in the video shows 63; the site shows 56/100 on our own rubric (2026-11-08). The device check on a real device, the breach lookup and the PDF report were not run. The AUTO-5 menu wording is not confirmed on a real Chrome for Android or Android 16. Re-recorded 2026-11-08 against pocketsec main af82be6; shows #88 AUTO-5 menu wording and #65 shorter habit summaries on the demo profile; the unmeasured 'sixty seconds' narration is now attributed to the button label; the changelog gap line is removed. Captions aligned and checked (worst cue 0.05 s); frame scan no hits. Re-encoded 2026-11-08. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.

Watch the PocketSec demo video on its own page, with its transcript

Email us about PocketSec

This button opens your email app with the subject already filled in. Your message comes to support@shipitworks.com. There is no form and no database. Privacy notice.

Works today

Each line links to the scorecard row that backs it.

Not finished

From the same scorecard, next to the claims.

  1. The web device check (AUTO-1..5), the habits audit (HAB-1..6), the password check and the PDF report have no test or proof log on the main branch; the web test suite and browser run of 2026-11-01 are on a branch that is not merged
  2. Shield Score, the build and the live site are each half credit: a recorded run exists, but no proof log for them is on main
  3. What leaves the device is not yet traced: no network capture is on main; the README on main says a no-transmission claim for the password and the page says '60-Second Security Scan' (not measured)
  4. AUTO-5 menu-path wording changed (#88), but its check script does not pass on Android and no log is committed
  5. No TWA or AAB; assetlinks.json still holds REPLACE_WITH_ placeholders; the Play 12x14 closed-test rule applies
  6. LICENSE.md is PolyForm Noncommercial while the plan says All rights reserved - mismatch unresolved
  7. No CSP header; no privacy page on main; contrast, keyboard and TalkBack not checked; dark theme is fixed with no light mode
  8. Native fix-text Settings paths: 4 of 5 found on a stock Android 36 emulator, 1 not found (Software update), exit 1 (proof/native-fix-paths.log, 2026-11-08T06:14:48Z); not a phone
  9. CHANGELOG.md on main still says there are no release tags (tags v0.1.0 to v0.5.0 exist); package.json says 0.1.0
  10. Web code has no test script in package.json; the only test run on main is the 43 native engine tests, on a Linux JVM, not a phone

Plainspoken

You type what you want; it rewrites a prompt an AI understands, then explains changes.

Scorecard

67/ 100

Stage: Beta on our own rubric. Google Play: Web only.

Primary journey: not shown

We checked it on 2026-11-08 with our own rubric. Code version: 847a36d.

Google Play: Web only

Plainspoken demo · 1:40Captions · Transcript

Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.

Watch the Plainspoken demo video on its own page, with its transcript

Email us about Plainspoken

This button opens your email app with the subject already filled in. Your message comes to support@shipitworks.com. There is no form and no database. Privacy notice.

Works today

Each line links to the scorecard row that backs it.

Not finished

From the same scorecard, next to the claims.

  1. e2e not run here (missing Chromium build); the live OpenRouter rewrite path and the live site have not been seen working
  2. No dark mode; two token pairs measure under 4.5:1 by arithmetic (ink-faint on desk 2.88, pen links 3.98), not yet fixed
  3. Rate limit is per server instance (in-memory, lost on restart), so it is weak on serverless
  4. .env.example is stale: it describes per-intent routing and a per-rewrite cost the README says was removed 2026-10-01
  5. No proof log for any feature on the main branch; five of seven are tested with sample data only, so they score half
  6. 64 open PRs (numbers 6 to 71, gh pr list 2026-11-08) are open and not merged to main; the privacy page, changelog and four test files from the audited branch are not on main
  7. The repo is private (gh api 2026-11-08), so the live site and the source link cannot be checked by a visitor from this packet; privacy lines stay not yet traced (the full prompt goes to OpenRouter by design)

graph-app

Give your AI coding assistant a map of your code.

Scorecard

64/ 100

Stage: Beta on our own rubric. Google Play: No Android app.

Primary journey: not shown

Scored 2026-11-08 on our own rubric; repository at commit daaacbf.

Google Play: No Android app

graph-app demo · 1:50Captions · Transcript

Audio loudness adjusted on 2026-11-05. Re-encoded on 2026-11-05 for faster seeking. Wording and picture content unchanged. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.

Watch the graph-app demo video on its own page, with its transcript

Email us about graph-app

This button opens your email app with the subject already filled in. Your message comes to support@shipitworks.com. There is no form and no database. Privacy notice.

Works today

Each line links to the scorecard row that backs it.

Not finished

From the same scorecard, next to the claims.

  1. Half the suite did not execute in the 2026-11-01 audit: 107 of 212 tests skipped because no Postgres was started for TEST_ADMIN_URL. A 2026-11-07 log shows 218 passed with Postgres up, from a dirty tree with no exit code; no clean run of main is recorded
  2. Not deployed; no live URL. Web app not tested yet: browser e2e and real GitHub sign-in not run
  3. MCP endpoint run with the official SDK client on a local stack only; not run from an AI assistant
  4. Benchmarks: 3 of 5 repos (click, marshmallow, toolz) re-scored from saved traces on 2026-11-07, self-run; the tests were not re-run to record new traces, the other engine was not re-run, toolz drove development, TypeScript repos not re-scored
  5. The references tool's completeness has not been measured (README 'Not done yet')
  6. Network egress not yet traced: where data goes is read from code, not captured
  7. No LICENSE and no CHANGELOG on main; source not published, licence not chosen (README)
  8. CI result on GitHub main not checked; the CI workflow moved to a self-hosted runner on 2026-11-08 (PR #21) and no run result is recorded
  9. Working copy ~/graph-app has uncommitted changes and a .env; the audited clone is clean

Graphsmith

A design-time environment for graph-based AI and automation workflows.

Scorecard

82/ 100

Stage: Beta on our own rubric. Google Play: Web only.

Primary journey: shown with sample data

Scored 2026-11-08 on our own rubric; repository at commit b9aca48.

Google Play: Web only

Graphsmith demo · 2:10Captions · Transcript

Recorded 2026-11-08. The scorecard in the video shows 67; the site shows 82/100 on our own rubric (2026-11-08, per-feature rule D32). The phone-size fix (#28) is not shown. Re-recorded 2026-11-08 against graphsmith main b9aca48; adds the State tab tagging a reviewer decision chosen in Evaluate as user, not mocked (#66), shows the readiness coverage tiles (#75), and the score, how-checked and gaps cards are reworded (score 67 as published, newer audit pending). The phone-size tab row fix (#28) is not shown. Voice is AI-generated (ElevenLabs). Captions timed by forced alignment, 24 cues, worst cue 0.1 s from speech; frame scan found no keys, addresses or paths. Voice is AI-generated (ElevenLabs). Shows made-up demo data. Read the transcript.

Watch the Graphsmith demo video on its own page, with its transcript

Email us about Graphsmith

This button opens your email app with the subject already filled in. Your message comes to support@shipitworks.com. There is no form and no database. Privacy notice.

Works today

Each line links to the scorecard row that backs it.

Not finished

From the same scorecard, next to the claims.

  1. Headless Chrome checks (check:ui 14/14, check:display 42/42) ran on one machine on 2026-11-07 and 2026-11-08; the read-only share view and other browsers are not covered, and no screen reader has been run
  2. graphsmith.dev was fetched once on 2026-11-07 and served the build checked then; a 2026-11-08 check:display run against it failed 4 of 42 (phone tab row), fixed on main in PR #28. Whether the live site serves b9aca48 is not yet traced; uptime was not measured
  3. A request capture of one journey on graphsmith.dev (2026-11-07) saw 0 requests after load and 3 during load; it does not cover browser extensions or other browsers
  4. npm audit ran from an offline cache, so the 0-vulnerability result is not independently confirmed
  5. A privacy page exists (#/privacy) and its network, storage and redaction sentences are pinned to the app code by tests; whether it meets a legal privacy-policy requirement was not checked
  6. CI on main head b9aca48 was queued, not green, when checked on 2026-11-08; last green run is 8b83b34
  7. package.json says 0.1.0 while the release tag is v0.4.0
  8. The independent proof pack (proof/proof-pack.json) is from 7c913f0 on 2026-11-02 with verdict STOP; its share-link defect is fixed by PR #20, but the pack was not regenerated, so test counts (153) are from that audit, not from b9aca48
  9. Proof logs cite the commit they ran on; except the three feature logs (bfa6b4d) those commits are branch tips replaced by squash merges, so they cannot be opened in main's history