Badge

Badge

A small, dated badge for your README or website that shows the result of your app’s latest check. It is off until you turn it on, and it shows a status, not your report.

What the badge can say

These are the real badges, drawn by the same code as the API:

The latest finished check found no leaks in the tables we test. The date is when it finished.

The latest finished check found leaks. A fix is ready or being reviewed, and not yet confirmed by a clean re-check.

The badge is public but no check has finished yet.

The badge isn’t public, the app isn’t verified, or the ID is wrong. Nothing about the app is revealed.

Turn it on

On the app’s page in your dashboard, switch on Public badge. Or with the API:

curl -s -X PATCH https://api.patchlabs.dev/apps/$APP_ID \
  -H "Authorization: Bearer $PL_SESSION" -H 'Content-Type: application/json' \
  -d '{"badge_public": true}'

Only verified apps can show a status. Switch it off the same way with false; the badge goes back to “private” within the hour.

Embed it

Paste your app ID (from the app’s page in your dashboard) to preview the badge and get snippets:

[![PatchLabs status](https://api.patchlabs.dev/badge/APP_ID.svg)](https://patchlabs.dev/proof?app=APP_ID)

<a href="https://patchlabs.dev/proof?app=APP_ID"><img src="https://api.patchlabs.dev/badge/APP_ID.svg" alt="PatchLabs status" height="20"></a>

What becomes public

Turning the badge on publishes three things and nothing else:

• the repo name,
• the status word (no_known_leaks, fix_in_progress or not_checked_yet),
• the date of the latest finished check.

Table names, the report, the fix and your team stay private. The badge links to your app’s public proof page, which shows the same status. The three fields are also available as JSON, for your own status page:

curl -s https://api.patchlabs.dev/public/apps/$APP_ID
# {"repo": "you/your-app", "status": "no_known_leaks", "last_checked": "2026-11-09T16:56:41+00:00"}
# 404 {"detail": "This app's status isn't public."} when the badge is off

Caching

The badge is served with Cache-Control: public, max-age=3600, so a new result can take up to an hour to appear. GitHub also caches README images through its own image proxy, which can add a little more.

What the badge means, and doesn’t