Patchhog

Catch the bug
on the way in.

Seven scanners on every push. Every finding ships with a paste-ready fix.

Try it for free See pricing

✓7-day free trial✓Cancel anytime✓SOC 2 Type II

What Patchhog catches before it ships.

CRIT.env:7AWS_SECRET=AKIA••••••3Q7K

HIGHconfig.ts:12STRIPE_SK=sk_live_••V2P

CRITapi/keys.ts:3GCP_SA=••account@iam

CRITworker.js:88PRIVATE_KEY=-----BEGIN••

MEDhelm/values:5SLACK_TOKEN=xoxb-••••a82

HIGHdocker.env:2GH_PAT=ghp_••••s8X1

CRIT.env:7AWS_SECRET=AKIA••••••3Q7K

HIGHconfig.ts:12STRIPE_SK=sk_live_••V2P

CRITapi/keys.ts:3GCP_SA=••account@iam

CRITworker.js:88PRIVATE_KEY=-----BEGIN••

MEDhelm/values:5SLACK_TOKEN=xoxb-••••a82

HIGHdocker.env:2GH_PAT=ghp_••••s8X1

Secrets

AWS, GCP, Stripe keys — never shipped to git.

SAST

Tainted input that reaches a dangerous sink.

Dependencies

Lockfile CVEs, patched version ready.

IaC

K8s, Terraform, Actions — bad defaults caught.

Malware

Typosquats and known-malicious packages, blocked.

Container

End-of-life base images and risky Dockerfile layers.

From bug to merged in one click.

Every finding lands with the patch already written. Hover the card to watch Patchhog ship the fix.

CRITICALMERGEDservices/auth/session.ts:42CWE-1321 · CVSS 9.8

40−import _ from "lodash";

40+import { merge } from "lodash-es/fp";

42−const cfg = _.merge(defaults, opts);

42+const cfg = merge(defaults, sanitize(opts));

WhyPrototype-pollution sink — opts merges directly into a config object without prior sanitization. CWE-1321 covers this class of mass-assign bugs across the npm ecosystem.

Pick a plan, push code.

All plans include every scanner, paste-ready fixes, and commit-status on GitHub. Cancel anytime.

7-day free trial · Cancel anytime

Solo

For indie hackers and side projects.

29€/ month

or 290€/yr — save 58€

Start 7-day trial

3 private repositories
All 7 scanners (Secrets, SAST, Deps, IaC, Malware, Container, API-Sec)
GitHub commit status + per-push & PR scans
SBOM export (CycloneDX)
Slack & Discord alerts

Things you ask
before you sign up.

01Which git hosts?+

GitHub only, for now. GitLab and Bitbucket are on the roadmap.

02Does Patchhog push the fix for me?+

Yes — for npm dependency CVEs on Pro and Business. Hit "Fix and push" on a finished scan and Patchhog bumps your vulnerable packages, regenerates the lockfile, and commits straight to the default branch under your own GitHub identity. Auto-fix for pip / cargo / go-mod is roadmap; for SAST and IaC findings you still get a paste-ready fix in the dashboard.

03Will my code leave my infrastructure?+

In self-host mode, never. In hosted mode, code lives in our scan worker for one scan only and is never trained on.

04How are rules defined?+

All rules are pure TypeScript in lib/scanner/. Append a regex/taint pattern/IaC check — the next scan picks it up.

Your next push
should already be safe.

Try it for free Read the docs→

Catch the bugon the way in.