Second Signer
Log inJoin the pilot

Release sign-off for apps built with AI · in build, pilot opening

Your coding agent says it's done. Second Signer checks it on a real screen before you ship.

a different model drives it · replayed 2 of 2 before it's reported · countersigned by you

A different model drives your build in a throwaway sandbox. A problem is only reported after it replays twice with no model involved. Then you countersign the release, and the record verifies offline.

Note: none of this is live yet. The first pilot founders, people shipping a web app from Claude Code or Cursor, get it first. See pricing

Is the invite fix done? Check it before I ship.

Run report · Not ready

2 failures reproduced on preview pr-412

Checked
6 flows
Reproduced
2, each replayed 2 of 2
Could not run
1, test login expired

Started by Claude Code on behalf of Sam Ortizrun r_8f3c · demonstration data

  • “When a test fails, coding agents fix the test. The suite goes green and the bug ships.”r/ChatGPTCoding, 20 Sep 2026
  • Lovable and Replit test your app with the same agent that wrote it.Lovable and Replit docs
  • Of 27 QA and testing vendors we checked on 11 Nov 2026, none offers a signed release record.Second Signer research
  • Under SOC 2 CC8.1, auditors check that a change was tested before it was deployed.Linford & Co

How a release gets signed

The agent that wrote it doesn't get to grade it.

14:02 · Claude Code

Your agent says it's done

Claude Code finishes the invite fix and calls Second Signer with the goal and the build: a preview URL, or your localhost through a tunnel that lasts one run.

14:06 · Second Signer

It's checked on a real screen

GPT-6.1 Terra drives the preview in a sandbox that can reach only the hosts you named, signed in with a test account it never sees the password for. When it finds something, it compiles the steps into a Playwright script and replays it twice in fresh sandboxes. 2 of 2, or it isn't reported.

14:31 · you

You countersign the release

When the release check passes, a card asks for your countersign. You open the Second Signer page, read what ran and what couldn't, and sign. The record names you, the time and the evidence pack, and anyone can check it offline with npx secondsigner verify.

Second Signer never approves anything. It runs, reproduces and prepares; a named person signs.

“Is the invite fix done? Check it before I ship.”

Check running

Checking the new invite flow on acme-web

Build
preview pr-412
Step
7 of up to 60

Started by Claude Code on behalf of Sam Ortizrun r_8f3c

2 failures reproduced on preview pr-412. Each replayed 2 of 2.

Run report · Not ready

Invite button does nothing on a second invite

Replay
2 of 2, no model calls
Seen on
preview pr-412

Reproduced by replayPlaywright script attached

Release 2.4.0 countersigned by sam@acme.dev at 14:31.

Countersigned

Release 2.4.0 is countersigned

Passed
38 flows
Could not run
1, iOS not set up
Signed
sam@acme.dev, 14:31

Prepared by Claude Code on behalf of Sam Ortizverify offline: npx secondsigner verify

Try it

The card your agent will show you

Switch between a passing run and one with reproduced failures, and open the countersign page.

Run report · Not ready

2 failures reproduced on preview pr-412

Checked
6 flows
Reproduced
2, each replayed 2 of 2
Could not run
1, test login expired

Started by Claude Code on behalf of Sam Ortizrun r_8f3c

Demonstration data. acme-web and Sam Ortiz are made up.

Countersign page

Choose “Ready to countersign” and press Review and countersign to open it here.

What the pilot gets

Built for founders without a QA person

Only reproduced problems reach you

Every candidate problem becomes a script and runs twice more with no model calls. A problem that shows up once gets one more look, never a ticket, so you don't spend your evening re-checking a model's hunch.

In build

Test passwords never reach the model

Second Signer signs in before the first screenshot, fills secrets by reference and refuses to type one into an unmasked field or an unlisted host. The sandbox can reach only the hosts you named.

In build

It works while you sleep

Nightly checks, a check on every Vercel or Netlify deploy, and Sentry spikes or bug emails reproduced on a real screen. Each card says what started it and on whose behalf, and a morning digest covers the rest.

In build

Your own cloud, or your own Mac

Teams that can't let screenshots leave their account can run Second Signer's runners in their own AWS, Azure or GCP account, or on a Mac they already own for iOS. Signing and countersign stay with Second Signer; the evidence stays with you.

In build

Pricing

Priced on checks

A check is one model-driven run: a change checked, an exploratory run, or a report reproduced. Replays of compiled scripts call no model, so they're included.

Free

$0

  • 1 app
  • 20 checks a month
  • Web
  • Countersign records
  • Evidence kept 30 days
  • 1 reviewer
Join the pilot
Most popular

Founder

$490 a year

  • 3 apps
  • 100 checks a month, then $0.60 each ($0.30 scheduled)
  • Web, Electron when it's ready
  • Schedules, deploy checks and bug-report reproduction
  • Your own runners and Macs, for your plan's surfaces
  • Evidence kept 1 year
  • 2 reviewers
Join the pilot

Team

$1,990 a year

  • 10 apps
  • 400 checks a month, then $0.60 each ($0.30 scheduled)
  • Web, Electron, Android and iOS simulator as each is ready
  • Security-review export of countersign records
  • Your own runners and Macs
  • Evidence kept 1 year
  • 5 reviewers
Join the pilot

A check counts once on every surface, including on your own runner or Mac. Only an iOS check on a simulator we rent counts as two. Prices are set now so you can judge fit before the pilot; billing starts when checks do.

Run Second Signer's runners in your own AWS, Azure or GCP account or on your own Macs, or against your own GPT-6.1 Terra deployment. Annual contract and security-review export.

Talk to us

Questions

What founders ask first

Isn't this what my coding agent's own tests are for?

Your agent's tests are written by the agent that wrote the code, and when one fails the fastest fix is often the test. Second Signer runs a different model against the built app, and nothing counts until a replay with no model reproduces it.

Does Second Signer approve releases for me?

No. It runs checks, reproduces failures and prepares a release record. A countersign happens only when a named person confirms it on a Second Signer page; no agent, card or API token can create one.

What can it test?

Web apps first, on a preview URL or your localhost through a single-run tunnel. Linux Electron and Android builds come next, then the iOS simulator.

Where do my screenshots go?

To the model under zero data retention, and into an evidence pack stored in our region. If that's not acceptable, the runners can run in your own cloud account and keep packs there. Note: OpenAI keeps images flagged by its abuse scanner for review even under zero data retention (OpenAI's data controls).

What does the pilot involve?

You connect Second Signer to Claude Code or Cursor on a web app you're shipping, and it checks real changes for two weeks. We want to know whether it catches something your agent called done.