PatchLabs v3: four product lines, and checks that read your code.
v2 found who could read your database. v3 adds a second engine that reads the rest of your repo, puts every result in one finding format, and organises PatchLabs into four product lines.
- New
Four product lines
Lab rebuilds your database from its migrations and reproduces each leak as an anonymous visitor, a signed-in stranger and the owner. Code reads the repo. Fix writes the migration, proves it and waits for your engineer. Watch re-checks, diffs, alerts and signs every result. Old product URLs redirect to the new ones.
- New
PatchLabs Code: new checks on every run
Reads the repo without running it or installing anything, and reports with a file and line: secret keys in the current code (
PL-009), Edge Functions open without sign-in while using the service key (PL-017), sign-ups without email confirmation (PL-018), access decided byuser_metadata(PL-019), admin checks only in the browser (PL-020), payment webhooks that don’t verify signatures (PL-021), functions that trust a user id from the request (PL-022), dependencies with known vulnerabilities from OSV (PL-023), user content rendered as raw HTML (PL-024), open Firebase rules (PL-025) and risky CORS (PL-026). The dependency check sends only package names and versions to OSV, and is reported as skipped when OSV can’t be reached. - New
One finding format
Every finding, from the Lab or Code, has the same fields: ID, line, severity, object, file and line, redacted evidence, whether it was proven, the proof and a one-line fix. The report groups findings by line, and a finished check’s API summary carries the list and counts by severity.
- New
Findings library and guides
A page for every finding ID from
PL-001toPL-026, each with vulnerable code, a self-check and the fix, and filters by line, severity and status. Plus a Learn section of in-depth guides: RLS with stranger tests, roles anduser_metadata, Edge Functions, Stripe webhooks, storage, views, Realtime, leaked keys, Firebase rules, dependencies and a pre-launch checklist. - New
A demo you can click through, and a rebuilt site
The real app on a fake demo workspace, clearly labelled, with no sign-in. A rebuilt home page, a products menu, integrations and pages for founders, agencies and the engineers who approve fixes.
Not in v3: five new Lab checks are written up but not tested yet: strangers changing other people’s rows (PL-012), users making themselves admin (PL-013), views skipping RLS (PL-014), open storage policies (PL-015) and Realtime streams (PL-016). Their pages say so, and they won’t appear in reports until they ship. Automatic pull requests still need the GitHub App, which is coming.
Measured effect: too new to measure. We’ll add numbers here once enough checks have run with the new code checks to report them honestly.