About
We rebuilt 318 AI‑built apps. About 1 in 4 exposed personal data. So we built the fix.
PatchLabs is a small, independent company in London, run by its technical founder. Our agents do the work. A person approves every change.
- Company
- PatchLabs
- Founder
- Manraj Singh Dhillon, technical founder
- Based
- London, UK
- Contact
- manraj@patchlabs.dev
- Security
- Same address, subject “Security”
- Independent
- Not affiliated with Lovable, Supabase, Bolt, Replit or Cursor
Why it exists
Building an app got easy. Checking who can read its data didn’t.
AI builders let anyone ship a real app with real users in a weekend. The app works, so nobody asks the awkward question: who else can read the users table? The database ships with a public key inside every page, and one loose access rule is enough for a stranger to read everyone’s email address.
We wanted a number, not a hunch. So we took public Lovable and Supabase repos and rebuilt each app’s database from its own migrations in a lab. Of the 318 that built a working database, 106 let the wrong people read personal data. After setting aside businesses’ own public contact details, it was about 1 in 4.
Finding the leaks wasn’t the hard part. Fixing them safely was: a rule tight enough to stop strangers, loose enough that real users can still read their own rows. So PatchLabs doesn’t stop at a warning. It writes the fix and proves it, as three different people, before anyone applies it.
- PatchLabs lab study, Nov 2026. 436 public repos run (from a random sample of 500); 318 built a working database. 106 of 318 (33%): 70 readable by anyone with the public key, 36 by anyone who signs up. About 1 in 4 (25–28%) after removing businesses’ own public contact details. No app is named.
- Autonomous pipeline on 20 new apps, 9 Nov 2026, n=20. Methodology.
Who runs PatchLabs
One founder, who answers his own email.
Manraj Singh Dhillon
Founder · technical founder · London
Manraj built PatchLabs and runs it: the lab, the fix pipeline, the API and this website. Every question, sales enquiry and security report comes to him directly, and you’ll get a reply from him, not a ticket number.
He writes the rules this site follows: no invented numbers, no borrowed logos, every study figure with its sample size, and the misses published next to the hits.
How we work
Agents do the work. Humans approve.
Machines are good at the repetitive part: rebuild, probe, write, test, repeat. People are better at the judgement calls. We split the work that way on purpose.
What the pipeline does
- Rebuilds your database from
supabase/migrationsin a disposable Postgres with Supabase’s roles, auth functions and default grants - Seeds fake rows and reads as an anonymous visitor and a signed-in stranger
- Writes the fix with the smallest Claude model first, a larger one only if the proof fails, under a spend cap
- Proves it: anon denied, stranger denied, owner still reads their own rows
- Scans your code and full git history for exposed keys, and re-checks on a schedule
What people decide
- Your engineer approves every change. Nothing reaches your app until someone applies the migration
- You answer the business questions, such as whether sellers’ emails should be public, with our recommended answer beside each one
- We review any fix the lab can’t prove. In our study that was 2 of 20
- The founder reads every security report and every correction
We never touch your database. Checks work from your GitHub repo only: they never connect to your live app or database, and we never need your database password. Live posture, if you turn it on, only loads your public home page, like any visitor, and only on domains you verify.
Principles
What we hold ourselves to.
01Truth only
No borrowed credibility.
No customer logos, testimonials, ratings or certifications until they’re real and we have permission. Every number on this site comes from our own work and says how big the sample was.
02Show the misses
Publish what didn’t work.
18 of 20 fixes passed with no human; we tell you about the other 2. Every report says what it couldn’t check.
03Independent
No partnerships to protect.
We aren’t affiliated with any platform we cover, so we can say what their tools do well and where ours fit. Our comparisons say when the other tool is the better choice.
04Private by default
No tracking.
No cookies and no third-party analytics on this site. Signed-in users can export or delete everything we hold.
05Plain English
Written for the person who shipped it.
Reports explain the leak in plain words, with the SQL one click away for your engineer. We state our limits as clearly as our features.
06Evidence over promises
We never say “secure”.
No guarantees, no “unhackable”. What we give you is a proof you can rerun and a receipt anyone can verify.
Contact
Talk to the person who built it.
Free check
Can a stranger read your users table? Find out in minutes.
Paste your public repo. You’ll get the leaks, the fix and the proof on one page.