Security
Responsible use
Patchlight finds vulnerabilities in source code. A tool that does that on your code can do it on anyone's, and pretending otherwise would be dishonest. This page sets out what we actually do about it, and what we expect of you.
The honest starting point
Source-code scanners are commodity tooling. Semgrep, CodeQL, gitleaks and a dozen others run offline, free of charge, on any checkout, with nobody watching. Someone intent on finding weaknesses in an open-source project has better options than a paid tool that records who they are.
So we do not claim to prevent that, and we are wary of designs that only look like they do. What we can do is make Patchlight a poor choice for it and a good choice for the opposite: attributable, bounded, and wired so that telling the maintainer is the path of least resistance.
Scanning code you did not write is also, very often, entirely legitimate — a dependency you are evaluating, a project you contribute to, a fork you maintain, a client codebase you were hired to assess. Controls that broke those uses would cost real users a great deal and cost a determined attacker nothing.
What we do
Every scan has a name on it
There is no anonymous access. Running a scan requires a signed-in account with a funded balance, so every scan is tied to a real identity and a real payment method. Anonymous, large-scale scanning is not something the product can do.
Every scan is recorded
We keep which account ran a scan, what it was pointed at, and when. That record is what an abuse investigation reads, and it is the reason we can act on a report rather than only apologise for one.
Limits, not just goodwill
Per-key daily scan caps, per-workspace spend caps and per-repository budgets bound what any one account can do in a day — including an account whose owner has decided to misuse it.
The reporting path is the easy path
When a scan targets a repository the account has not connected, Patchlight says so and offers to draft a private disclosure and open the project's advisory form. Reporting responsibly is one click; nothing else is.
What we expect of you
If you scan code you do not maintain and Patchlight finds something real, take it to the people who can fix it — the project's published security policy, or a private advisory — and give them a reasonable window before it goes anywhere else. Do not publish it, sell it, or use it. This is a condition of using the Service, set out in the acceptable-use section of our Terms.
An automated finding is a lead, not a proof. Read the code before you report it: a maintainer's time is the scarcest resource in open source, and a queue of unverified scanner output is a way to waste it at scale.
Reporting abuse
If you believe Patchlight has been used against your project by someone with no right to, write to abuse@patchlight.dev. Name the repository and roughly when, and we will check it against our records.
Two things we will do: investigate, and act on the account — suspension or termination, where the Terms have been breached. One thing we will not: tell you who it was. We do not disclose a user's identity to a third party outside a valid legal process, and we would rather say that plainly here than imply otherwise and disappoint you later.
Found a vulnerability in Patchlight itself? That goes to the same address, or through the security channel on our contact page. Tell us privately first and we will keep you posted while we fix it.
This page describes the product as it stands today. If a control listed here stops being true, this page changes with it.