Terms of service

01Who we are

PatchLabs (“we”, “us”) is run by Manraj Singh Dhillon in London, United Kingdom. You can reach us at manraj@patchlabs.dev. “You” means the person using PatchLabs and, if you use it for a business, that business.

02What PatchLabs does

PatchLabs reads a GitHub repository, rebuilds the app’s database from its supabase/migrations in a disposable lab with fake data, tests what an anonymous visitor, a signed-in stranger and the owner can read, writes a fix and re-tests it in the lab. It also scans the code and git history for exposed keys. These checks never connect to your live app or database.

Live posture is optional. If you set and verify a domain for an app (with a file or meta tag on that domain), PatchLabs loads that domain’s public home page once a day, as any visitor’s browser would, and grades its HTTPS, certificate, security headers, cookie flags and mixed content. It requests no other paths, submits no forms and never touches your database. The free headers check does the same single page load for a public address you enter, and keeps no result. You may only enter addresses you are allowed to check.

Today we support public repositories only. Fixes are delivered as a downloadable migration and a “commit this file on GitHub” link; we do not push to your repository. Features we describe as “coming” (such as private repos and automatic pull requests through a GitHub App) are not part of the service until we announce them on the changelog.

03Accounts and workspaces

• You sign in with a link sent to your email. Keep access to that inbox secure: anyone who controls it can sign in as you.
• You can start a free check without an account. Anyone with a report link can open that report.
• Workspace owners can invite members, change roles, create API keys and remove members. Owners are responsible for who they let in.
• Give us accurate information, and tell us if you think someone has accessed your account.

04Your authorisation to check a repo

You may only submit repositories that you own or that you are authorised in writing to test (for example, by your client or employer). Before a full check runs, you must prove control of the repository by committing patchlabs-verify.txt with the one-time code we give you. You must follow our acceptable use policy.

05Your code and content

You keep all rights in your code, your reports and anything else you give us. You give us a limited licence to copy, store and process it only to provide PatchLabs to you: to clone it, rebuild it in the lab, send relevant parts to our AI model provider, and produce your reports, fixes and receipts.

We don’t use your code or reports to train AI models, and we don’t publish anything that identifies your app. Our published research uses aggregate counts only.

The fixes, reports and receipts we produce for you are yours to use, change and share as you like.

06Fixes and your approval

A fix marked “proven” has passed our lab tests for the tables we checked: the anonymous visitor and signed-in stranger were denied, and the owner could still read their own rows. You (or your engineer) are responsible for reviewing every fix, testing it as you see fit, and deciding whether to apply it. We never merge or deploy changes for you. Back up your data before applying any migration.

07Plans, limits and payment

• The Free plan costs nothing and includes the limits shown on the pricing page.
• Card payments are not live yet. Paid plans are available on request: you ask for an upgrade, we confirm the price and terms by email, and we set your plan. We will never charge you without your written agreement.
• Limits (apps, re-check schedules, manual runs, team seats) are enforced by the service. If you reach one, the service tells you; it doesn’t silently drop checks.
• Prices can change. Changes apply from your next billing period, and we’ll email you at least 30 days before.

08API, webhooks, MCP server and badges

• Keep API keys secret. You’re responsible for calls made with your keys; revoke a key as soon as you think it has leaked.
• Use the API, MCP server and free tools at a reasonable rate. We rate-limit and may block automated abuse.
• If you enable a public badge or proof page, it shows your repo’s name, its current status and the date of the last finished check. It reflects our last check only. It is not a certification and you must not present it as one.

09Availability

We work hard to keep PatchLabs running, and we publish live status at /status. Checks run on a single worker machine, so they can queue. Unless we agree otherwise in writing, we don’t offer a service level agreement. We may change or retire features; if a change materially reduces a paid plan, we’ll tell you in advance and you can cancel.

10What we don’t promise

PatchLabs tests database access rules and looks for exposed keys. It is not a penetration test and does not check your whole app. The lab is only as complete as the migrations in your repo. A report with no leaks, or a proven fix, does not guarantee that your app is secure or compliant with any law. Except as set out in these terms, the service is provided “as is”.

11Liability

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law. If you use PatchLabs as a consumer, you keep your statutory rights.

Otherwise, we are not liable for indirect or consequential loss, or for loss of profit, revenue, data or goodwill. Our total liability to you in any 12-month period is limited to the greater of the fees you paid us in that period and £100.

12Ending the agreement

You can stop using PatchLabs and delete your account at any time from Settings. We may suspend or close an account that breaks these terms or the acceptable use policy, or that puts others at risk; where we can, we’ll warn you first and explain why. When an account is deleted, we delete its data as described in the privacy policy.

13Changes to these terms

We’ll update the date at the top when we change these terms, and email account holders at least 30 days before a material change takes effect. If you keep using PatchLabs after that, the new terms apply.

14Law and disputes

These terms are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction. If you are a consumer living elsewhere in the UK, you may also bring proceedings in your local courts. Please talk to us first: most problems are solved by an email.

15Contact

PatchLabs, London, United Kingdom
manraj@patchlabs.dev