Every migration you merge can reopen a leak. Watch re-checks.
Scheduled re-checks compare each run with the last and alert your team only when something new appears. Share the result with a dated badge, a public proof page and a receipt anyone can verify.
profiles- Next scheduled re-check · weeklyin 7 days
- First check · 1 table leaking:
profiles· lab proof passed9 Nov 16:57
manra399/patchlabs-demo-app: 1 table leaking (profiles). A lab-proven fix is ready.
How it works
Schedule, compare, alert, share.
Schedule
Weekly or monthly, by plan. Run one by hand, or from CI, any time.
schedule: weekly next check in 7 daysCompare
Each finished check is compared with the one before: new, fixed, still leaking, marked as intended.
new 1 · fixed 0 still 0 · intended 0Alert
Email every member when a new leak appears, and POST a signed webhook that works as a Slack incoming webhook.
X-PatchLabs-Signature v1=…Share
An opt-in badge and public proof page, and an Ed25519-signed receipt for every finished check.
receipt · Ed25519 verify in browser
Capabilities
Monitoring, sharing and teams.
All live today, on every plan. Plans differ only in apps, schedule and seats.
Scheduled re-checks
Weekly or monthly, with a full Lab and Code run each time. Monitoring.
What changed since last time
New leaks, fixed, still leaking, and tables your team marked as intended.
Email alerts
To every member of the workspace, with “new leak” in the subject only when there is one.
Badge and proof page
A dated badge for your README or site, linked to a public proof page. Off until you turn it on.
Live posture
A daily A-to-F grade for HTTPS, the certificate, security headers and cookies on the domain you verify. Live posture.
MCP tools
list_apps and run_check for monitored apps, from your coding agent.
Badge & proof page
A dated, public record of your last check.
The badge shows the result of your last finished check and when it ran. It links to a proof page that says what was tested and what isn’t covered. It never hides a leak: it stays amber until a re-check comes back clean.
A badge is not a certification. It reports our last check of the access rules and code in your repo.
[](https://patchlabs.dev/proof?app=<app-id>)Live posture
Your live site’s HTTPS and headers, graded daily.
Verify your app’s domain with a file or a meta tag, and Watch also loads your public home page once a day, like any visitor, to grade HTTPS, the certificate, security headers, cookie flags and mixed content. Your team hears about it when the grade drops.
PatchLabs never touches your database. Live posture only loads your public home page, like any visitor, and only on domains you verify.
Sample output
The webhook every finished check sends.
The text field makes it work as a Slack incoming webhook as-is. Everything else is structured for your own tools, signed so you can trust it.
- Rejects replays: check the timestamp is within 5 minutes
- Rotate the secret any time; the old one stops at once
- Private and loopback addresses are refused as targets
X-PatchLabs-Timestamp: 1762707420
X-PatchLabs-Signature: v1=<hex HMAC-SHA256>
{
"event": "check.finished",
"text": "manra399/patchlabs-demo-app: 1 table leaking (profiles). A lab-proven fix is ready. https://patchlabs.dev/check?id=…",
"check": {
"repo": "manra399/patchlabs-demo-app",
"status": "done",
"tables_leaking": ["profiles"],
"url": "https://patchlabs.dev/check?id=…"
}
}What Watch can’t see. Re-checks read your repo, not your live database, so a change made by hand in the Supabase dashboard won’t show up until it’s in a migration. Live posture reads only the headers and settings of your public home page. Monitoring isn’t uptime or runtime protection, and a badge isn’t a certification.
Do scheduled re-checks use my monthly runs?
No. Scheduled re-checks are never counted, and keep running even if you use all your manual runs.
Will I get an alert every week?
Only when something new appears. Every member gets an email per finished check, and the subject says “new leak” only when there is one. Tables your team marked as intended don’t raise alerts.
Can anyone verify a receipt?
Yes. Receipts are signed with Ed25519 and the public key is published at /.well-known/patchlabs-receipt-key. The proof page verifies them in your browser.
Is the badge public by default?
No. It’s off until an owner turns it on for an app. A private app’s badge shows only “private”.
Free check
Start watching your app today.
Your first check is free. Add the app to your workspace and it re-checks on a schedule.