Meet your engineer

Ocean Longnion

Every Craft & Ship app is personally reviewed by Ocean Longnion, a senior full-stack engineer with 26 years of production experience.

Ocean has built and scaled systems at Adobe, CoStar Group, HomeAway (now Vrbo), and lynda.com (now LinkedIn Learning). When your app is ready, Ocean reviews every line for security, reliability, and quality; the same review a $15,000 agency would charge for, included in every build.

How we co-create

Every step has a human checkpoint. You are never talking to a machine with no one watching.

Your pace, your choice

Some customers want to be involved at every step. Others want to describe what they need and get a link to their live app. Both are welcome.

The human review always happens, either way. A senior engineer always looks at your app before it goes live. If we catch something important, we reach out. The safety net is always there; how involved you want to be is entirely up to you.

Why this matters

There are now dozens of tools that let you generate a web app with AI. Most produce something that looks finished in a screenshot and breaks the first time a real person uses it.

Craft & Ship exists because we believe your business deserves software that was reviewed by someone who knows what they are looking at. Your customers deserve an app that works reliably, every time, because a real engineer made sure it would.

AI makes it fast. Humans make it right. Together, we make it yours.

A note from Ocean

We are real humans at Craft & Ship.

We get that you have something special to offer the world. You want to create something useful and helpful for other people. That deserves more than AI-generated code, pre-made templates, and cookie-cutter solutions.

We will team up with you. AI is our tool and assistant, but the humans make the final decisions on something this important. Your app, your business, your customers: they deserve real care and real attention from someone who has been building software for over two decades.

With care and intention,

Ocean

The build pipeline

Six-stage automated pipeline. Real code is generated, tested, and deployed. If a stage fails, the pipeline self-corrects and retries before escalating to a human.

01

Intake

AI conversation extracts requirements: pages, data models, user roles, business logic, auth requirements.

02

Specification

Requirements compiled into a structured JSON spec defining every page, route, database table, and CRUD operation.

03

Code generation

Claude (Anthropic) writes the full application: backend routes, DB schema, EJS views, auth middleware, admin panel, seed data (15+ realistic records per table).

04

Automated testing

Playwright runs 20 smoke tests: health check, auth flow, CSRF, XSS, button visibility, all spec routes return 200, CRUD list pages show seed data, form submissions work, no 500s on crawl.

05

Code review

Automated review checks every route against spec, verifies requireAuth coverage, validates CSRF tokens on all POST forms, checks for XSS in EJS.

06

Senior engineer review

30–90+ minutes of human review: security, reliability, UX, edge cases. Blocking gate before deploy.

07

Deploy

Railway cloud: managed PostgreSQL, SSL via Let's Encrypt, health monitoring, automatic self-healing, daily backups.

Fix loops run up to 4× on test failure, 3× on deploy failure. If the pipeline can't self-heal, the build is reviewed and corrected by Ocean before requeue.

Tech stack

Every generated app runs the same production-grade stack. Standard, well-documented technology — no proprietary runtime.

File structure

Standard Node.js project layout. No framework magic, no config-as-code. Every file is what it looks like.

your-app/
  server.js          # Express entry point
  routes/            # Page + API handlers
  views/             # EJS templates
  db/
    schema.sql       # Table definitions
    seed.sql         # 15+ realistic rows/table
    index.js         # Shared connection pool
  middleware/
    auth.js          # requireAuth, CSRF
  public/            # CSS, JS, images
  package.json

Run locally: npm install && npm start: Deploy anywhere: Railway, Render, Heroku, your own VPS.

Security defaults

Every app ships with these on by default. No configuration required.

• CSRF protection: HMAC-SHA256 stateless tokens on every POST form
• XSS prevention: Automatic EJS template escaping enforced; output tags use safe HTML-escaped rendering by default
• SQL injection protection: Parameterized queries throughout, no string concatenation
• Password hashing: bcrypt (12 rounds), never stored in plaintext
• HTTPS: Automatic SSL, HSTS header in production
• Secure cookies: httpOnly, sameSite=lax, secure=true in production
• Email verification: 24-hour SHA-256 hashed tokens, single-use
• Destructive action confirmation: data-confirm dialogs on all delete/reset operations

Monitoring & self-healing

• Health checks: Every 15 minutes; detects outages within minutes
• Latency tracking: EMA baseline; alerts when response times spike >2×
• Auto-healing: Dependency mismatches, env config, infrastructure failures resolved automatically
• Escalation: Anything the system can't resolve triggers a human alert immediately
• Daily backups: pg_dump snapshots, 7-day retention, one-command restore
• Human approval gate: Any automated fix that touches data or business logic requires human sign-off

Source ownership

You own the source code. No lock-in, no proprietary runtime, no strings attached.

• Download a tar.gz archive from your dashboard at any time
• Run locally with npm install && npm start
• Modify anything: routes, views, schema, styling
• Deploy to any Node.js host: Railway, Render, Heroku, your own server

Standard dependencies only. npm install works offline.