Skip to content
PatchLabs
Products

Four product lines, one report

LabRebuilds your database from its migrations and reproduces each leak as anon, stranger and owner. CodeReads the repo: keys in code and history, vulnerable dependencies, risky AI-written patterns. FixWrites the migration, proves it as three identities, then waits for your engineer to approve. WatchScheduled re-checks, diffs, alerts, a public badge and signed receipts for every result. Live posture part of WatchA daily grade for HTTPS, the certificate, security headers and cookies on the domain you verify. Never touches your database.

See it work

  • Try the demo No sign-in
  • Sample proof report
  • How it works
  • Findings library
  • Integrations
Solutions

Who it’s for

FoundersYou built it with AI and real people are signing up. AgenciesEvery client app you ship, watched after handover. Engineers who approveThe SQL, the proof and the receipt. Nothing ships without you.

Works with apps built on

  • Lovable
  • Supabase
  • Bolt
  • Replit
  • Cursor

Compatibility, not partnerships.

Resources

Learn and look things up

LearnIn-depth guides to securing AI-built apps. ResearchThe 1-in-4 study and how we measured it. Findings libraryEvery check by ID, with the fix. DocsReports, API, webhooks, MCP and CI. ChangelogWhat shipped, dated. Free toolsRLS check, headers check and leak-cost calculator. StatusAPI and worker health, live. Leaking right now?What to do in the next hour.
Study We rebuilt 318 public apps. About 1 in 4 exposed personal data. Read the study
Pricing Docs
Sign in Try the demo Check my app free
Legal pages

Legal

  • Terms of service
  • Privacy policy
  • Acceptable use
  • Data processing
  • Disclosure policy
  • Cookies

Trust

  • Security
  • Status
  1. Home
  2. Legal
  3. Cookies

Draft for review, last updated 10 November 2026

We set no cookies.

That’s why there’s no cookie banner. patchlabs.dev runs no analytics, no advertising and no tracking pixels.

01What your browser does store

Two small items in your browser’s localStorage. They never leave your device except as described, and we can’t read them from our side.

NamePurposeSet whenRemoved when
pl_sessionKeeps you signed in. Sent to our API as an Authorization header, never as a cookie.You sign inYou sign out or clear site data. Our API stops accepting it after 30 days.
pl_themeRemembers light or dark mode.You press the theme buttonYou clear site data

Both are strictly necessary for something you asked for (staying signed in, keeping your theme), so UK law (PECR) does not require a consent banner for them.

02Files loaded from other services

Pages load fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com), and the report page loads two open-source libraries from cdnjs (cdnjs.cloudflare.com). Those requests go to the providers’ own domains, which see your IP address and browser details. patchlabs.dev does not ask them to set cookies, and any they use are governed by their own policies. The site is hosted on GitHub Pages, which keeps standard server logs.

03How to clear it

Sign out to remove pl_session. To remove everything, clear “site data” for patchlabs.dev in your browser settings. The site works without either item: you’ll just need to sign in again, and the theme will follow your device setting.

04If this changes

If we ever add analytics, we’ll use a cookieless, self-hosted tool, update this page first and say so on the changelog. More in the privacy policy.

Draft awaiting legal review.

On this page

  • What we store
  • Other services
  • Clearing it
  • Changes

Free check

Can a stranger read your users table?

Paste a public repo. Leaks, the fix and the proof on one page, usually within minutes.

Check my app free → Try the demo
PatchLabs

Find the leak. Prove the fix. A security platform for apps built with AI: Lab, Code, Fix and Watch.

manraj@patchlabs.dev
London, UK

System status

Products

  • Lab
  • Code
  • Fix
  • Watch
  • Live posture
  • Try the demo
  • Integrations
  • Pricing
  • How it works

Solutions

  • Founders
  • Agencies
  • Engineers
  • Lovable apps
  • Supabase apps
  • Bolt apps
  • Replit apps
  • Cursor projects

Resources

  • Learn
  • The 1-in-4 study
  • Methodology
  • Findings library
  • Sample report
  • Free tools
  • Leaking right now?
  • Changelog

Developers

  • Docs
  • REST API
  • MCP server
  • GitHub Action
  • Webhooks
  • Signed receipts
  • Free RLS check
  • Free headers check
  • Status

Compare

  • All comparisons
  • Supabase Security Advisor
  • Lovable security scan
  • Aikido
  • Manual pentest
  • URL scanners

Company

  • About
  • Security
  • Email the founder
  • Terms
  • Privacy
  • Acceptable use
  • Data processing
  • Disclosure policy
  • Cookies (none)
© 2026 PatchLabs Changelog feed llms.txt security.txt

Independent: not affiliated with Lovable, Supabase, Bolt, Replit, Cursor or GitHub. Names are used to describe compatibility only. No cookies, no third-party analytics.