Try the demo Check my app free
Product linePatchLabs Fix

A fix you’ve watched work, waiting for your approval.

The fix agent writes a migration for each Lab finding. The lab re-tests it as every identity. If anything fails, it isn’t called proven. Then a person decides: your engineer approves, downloads the file or commits it on GitHub in one click.

Check my app freeTry the demo

Nothing reaches your live app until your engineer applies it

The real fix from our demo app’s check, 9 Nov 2026. See it in the report.

How it works

Write, prove, ask, approve.

Each stage leaves an artifact you can inspect.

  1. Write

    The smallest Claude model writes the migration first; a larger one only if the proof fails. Spend is capped per check.

    + create policy … using (auth.uid() = user_id)

  2. Prove

    Re-run the probes as anon, stranger and owner on the fixed database. All three must pass.

    anon DENIED stranger DENIED owner OK

  3. Ask

    When the right answer is a business choice, the report asks in plain English, with a recommended answer.

    Should sellers’ emails be public? → no

  4. Approve

    Approve the fix, or mark a table as meant to be readable. Download the SQL or commit it on GitHub.

    supabase/migrations/ …_patchlabs_leak_fix.sql

Capabilities

Everything between a finding and a merged fix.

Live means it works today. Coming means it needs our GitHub App, which isn’t released yet.

Applying a fix
Fix agentlive

Migrations for Lab findings

Written against your rebuilt schema, with a comment explaining what changed and why.

Prooflive

Three-identity proof

Anonymous visitor denied, signed-in stranger denied, owner still reads their own rows. How proof works.

Decidelive

Owner decisions and questions

Approve, or mark tables as intended so later checks stop alerting. Answers go into the signed receipt. Decisions.

Deliverlive

Migration file and GitHub commit

Download the .sql, or open GitHub’s new-file page prefilled at supabase/migrations/.

Agentslive

MCP server

Claude Code, Cursor, VS Code and Windsurf can start checks and read fixes. MCP.

CIlive

GitHub Action

Re-check when a migration lands; fail the build while a leak is open. GitHub Action.

Codelive

Precise fixes for Code findings

File, line and the one-line change for each Code finding. These are code changes, not lab-proven.

GitHub Appcoming

Automatic pull requests

The fix opened as a pull request on your repo. Needs our GitHub App.

GitHub Appcoming

Private repos

Checks and fixes for private repositories. Needs our GitHub App.

Prove

A fix only counts when it passes three checks.

Every fix we hand over has been tested in the lab as three different people. If any check fails, it is not called proven.

Anonymous visitorDENIED
-- with your app's public key
select * from public.profiles;
→ 0 rows

Anyone on the internet has your public key; it ships inside your app. After the fix they read nothing.

Signed-in strangerDENIED
-- signed in as a different user
select * from public.profiles;
→ 0 rows

Anyone can create an account. Signing up must not unlock other people’s rows.

OwnerOK
-- signed in as the row's owner
select * from public.profiles;
→ 1 row, their own

A fix that locks real users out is not a fix. The owner must still read their own data.

supabase/migrations/20261109165700_patchlabs_leak_fix.sql
-- Fix: replace the "everyone can read" policy with owner-only access.
DROP POLICY "Profiles are viewable by everyone" ON public.profiles;
CREATE POLICY "Users can view own profile" ON public.profiles
  FOR SELECT USING (auth.uid() = user_id);
18of 20passed the strict lab proof with no human1
15needed only the smallest model1
2went to a person1
  1. Autonomous pipeline on 20 new apps, 9 Nov 2026, n=20. Small sample, published with the misses. Methodology.

What Fix doesn’t do. It never merges or applies anything by itself: a person always approves. Automatic pull requests and private repos need our GitHub App, which is coming. A proven fix covers the access rules we test, not the whole app; it isn’t a pentest or a compliance certification.

Questions

Questions about this product line.

Something not covered? Email the founder.

What if the fix can’t be proven?

Then we don’t call it proven. The report says a person is reviewing it, and explains why. In our lab study 2 of 20 fixes went to a person.

Can my coding agent apply the fix?

Your agent can start checks and read the fix through our MCP server. Whether it applies the migration is up to you and your engineer; we never push to your repo.

Which model writes the fix?

Claude models from Anthropic: the smallest first, a larger one only if the lab proof fails, with a spend cap on every check. The model sees the relevant code, never your customers’ data.

Do you open pull requests?

Not yet. Today you download the migration or commit it on GitHub in one click. Automatic pull requests come with our GitHub App.

Free check

See a fix proven on your own app.

Paste your public repo. If we find a leak, you get the migration and its proof on one page.

Prefer a person first? Email the founder Try the demo See a sample proof report