Security & trust
Built for teams that review their vendors.
Patchflare works on the assumption that any repository it touches may contain hostile code, and that a patching agent must never be able to do more than open a pull request. This page is the review packet.
Controls
What we do, stated plainly.
Isolation by default
Every patch job runs in its own single-use environment on an isolated network, one repository at a time. It is destroyed when the job ends, whether it succeeded or not.
No standing credentials in runners
Runners hold no cloud credentials. They receive a job description and return results through pre-signed, single-purpose URLs. Repository access is a short-lived GitHub App token scoped to one repository.
Least privilege on GitHub
The GitHub App requests only the permissions listed below and can be installed on selected repositories. Per-repository controls decide who may trigger the agent from a pull request comment.
Nothing in your CI
No workflow files, no runners in your infrastructure, no secrets to rotate. Removing Patchflare is uninstalling the GitHub App.
Human approval, always
Patchflare opens pull requests. It does not merge, force-push, or change branch protection. Your review process stays exactly as it is.
Deterministic scope gate
Before a pull request is opened, a rule-based check confirms the diff stays within dependency files and the call sites a major upgrade requires. Out-of-scope changes fail the job.
Encrypted, tenant-isolated data
Findings, evidence and tokens are encrypted at rest in a per-tenant data model with organisation-scoped access on every query. Installation tokens are encrypted with a dedicated key.
Append-only audit trail
Every state change on a finding, every agent action, every exception and every SLA event is recorded with actor and timestamp and exported in compliance reports.
Data handling
What we store, for how long, and who can see it.
| Data | Where | Retention | Notes |
|---|---|---|---|
| Source code | Single-use runner only | Job lifetime | Never written to the control plane. Diffs appear in your GitHub pull request. |
| Findings, evidence, SLA history | Control plane database, US East | Life of the account | Organisation-scoped. Exported on request; deleted within 30 days of account closure. |
| Agent session logs | Control plane, encrypted object storage | 180 days | Secrets and tokens are redacted before storage. |
| GitHub installation tokens | Control plane, encrypted | Until expiry, ≤ 1 hour | Scoped to one repository and the minimum permissions for the job. |
| Model prompts | Anthropic API | Provider policy, no training | Dependency manifests, advisory text, release notes, relevant call sites. |
| Compliance reports | Encrypted object storage | Life of the account | Download links expire after ten minutes. |
Platform
Where it runs and how access works.
Hosting
AWS, us-east-1, in a dedicated account. Public hostnames sit behind Cloudflare with WAF and rate limiting; the origin accepts traffic from Cloudflare only.
Identity and access
Sign-in through WorkOS with SSO (SAML and OIDC) available for enterprise plans. Organisation roles plus per-repository roles decide who can enroll repositories, run the agent and grant exceptions.
Staff access
Internal consoles are reachable only through a zero-trust gateway with hardware-key MFA, and every staff action on customer data is logged.
Availability and incidents
Status and incident communication by email to your security contact. We will publish a public status page before general availability.
GitHub App permissions
Exactly what the app asks for.
| Permission | Level | Used for |
|---|---|---|
| Repository contents | Read & write | Clone for scanning and patching; push the fix branch. |
| Pull requests | Read & write | Open the PR, read review comments, reply. |
| Checks | Read | Follow CI results on the PR. |
| Metadata | Read | Repository list, default branch, languages. |
| Dependabot alerts | Read, optional | Merge Dependabot findings into the same queue. |
Events subscribed: pull request, pull request review, issue comment, installation, repository. No access to actions, secrets, or organisation members.
Questions
Security review questions
The questions we are asked in vendor reviews, answered in advance. Everything else: security@patchflare.com.
security@patchflare.com for anything not answered here.
Which permissions does the GitHub App need?
Read access to repository contents and metadata to scan; write access to contents and pull requests to open a branch and a PR; read access to checks to follow CI. Install it on selected repositories only. Every token minted for a job is scoped to that one repository and expires within the hour.
Where does our code go?
Into a single-use runner for the duration of one job. The runner clones the repository with a scoped token, applies the upgrade, runs your build and tests, rescans, pushes a branch and is destroyed. Source code is not stored in the control plane; findings, evidence and logs are.
Which AI model is used?
Anthropic's Claude models through the commercial API under terms that exclude training on customer data. Prompts contain the dependency manifest, the advisory, release notes and the call sites relevant to the upgrade.
What if the agent makes a mistake?
It cannot merge. A deterministic scope gate rejects changes outside dependency files and the required call sites, the pull request shows the full diff and test output, and your reviewer can ask for a revision or close it.
Can we get a penetration test report or fill in a questionnaire?
Yes. Email security@patchflare.com. We answer SIG Lite and CAIQ style questionnaires and share our latest third-party assessment under NDA.
Bring your security questionnaire.
We will walk through the architecture live, on a call with your security team, and follow up in writing.