For apps built with Lovable, Replit and Bolt
1 in 4 AI-built apps we tested leak customer data.
PatchLabs finds the leaks in your app, writes the fix and proves it works before anything ships. Your engineer approves it with one merge.
Your email app should open with the request filled in. Press send and we’ll reply within one working day. If it didn’t open, email hello@patchlabs.dev.
Read-only code access. We never touch your live app or see your customers’ data.
public Lovable and Supabase apps rebuilt in our lab
let strangers read personal data like emails and phone numbers
of our agent’s fixes worked first time, re-checked in the lab
PatchLabs lab study, November 2026: public GitHub projects only, code-only, no live systems accessed.
How it works
- 01
Share your repo
Read-only GitHub access. Works with apps built in Lovable, Replit, Bolt or Cursor.
- 02
We rebuild your database
In our lab, from your own migrations, with fake data. Your live app and customer data are never touched.
- 03
Agents find and fix
They check who can read what, write the fix, and prove it closes the leak without locking out your users.
- 04
You approve
You get a pull request with the proof and any questions in plain English. Nothing ships until your engineer merges it.
What we check
- Who can read your data
- Database access rules that let anyone, or anyone who signs up, read other people’s records.
- Exposed keys
- AI, payment and database keys in your code and in its full git history, with where to rotate each one.
- Open AI endpoints
- Functions that call paid AI models without a login, so anyone can run up your bill.
- Payment webhooks
- Stripe events accepted without a signature check.
Every change comes with a receipt
What our agent found, what it changed, the lab proof, and who approved it. One record per fix, owned by you. Useful when a client or an auditor asks what was done to their app.
Built for agencies
Keep every client app you’ve shipped checked after handover. Fixes arrive as pull requests your team approves, and business questions go to your client in plain English.
Questions
Do you need my database password?
No. We work from your code alone. The fix arrives as a pull request, and it reaches your live app through your normal deploy once you merge it.
What if a fix breaks something?
Every fix is tested on a rebuilt copy of your database first. If a page would behave differently, the pull request says so, and any change that page needs is included.
Who decides who should see what?
You do. When a fix depends on a business choice, for example whether sellers’ emails should be public, we ask you in plain English with a recommended answer.
Is it really free?
Your first app’s check is free. Agencies managing many client apps get plans priced per app.
Find out if your app leaks. Free, in 48 hours.
Your email app should open with the request filled in. Press send and we’ll reply within one working day. If it didn’t open, email hello@patchlabs.dev.