GitHub only, for now. GitLab and Bitbucket are on the roadmap.

Yes — for npm dependency CVEs on Pro and Business. Hit "Fix and push" on a finished scan and Patchhog bumps your vulnerable packages, regenerates the lockfile, and commits straight to the default branch under your own GitHub identity. Auto-fix for pip / cargo / go-mod is roadmap; for SAST and IaC findings you still get a paste-ready fix in the dashboard.

Each scan runs in an isolated worker that pulls your repo over the GitHub API, runs the scanners, and discards the working copy the moment it finishes. Nothing is mirrored, cached across repos, or used to train anything — Patchhog runs no AI at all. Self-hosting isn't available yet, but the bundled CLI runs locally for pre-commit and CI.

Battle-tested engines under one roof — Semgrep for SAST, Trivy and Gitleaks for IaC and secrets, and Google's OSV for dependency CVEs — alongside Patchhog's own checks for malware and typosquats, end-of-life base images, and OpenAPI security. Every finding is normalized, de-duplicated, and ships with a paste-ready fix.

Every plan gets all 7 scanners, GitHub commit status with per-push and PR scans, SBOM export (CycloneDX), and Slack and Discord alerts — the tiers differ on repos and automation. Solo covers 3 private repos; Pro covers 15 and adds the "Fix and push" auto-fix for npm dependency upgrades plus priority email support; Business is unlimited repos and is the only tier with Cloud scanning (AWS/GCP/Azure), DAST runtime probing, EASM, and compliance exports (SOC 2 / ISO / NIST).

Automatically on every push to your default branch, and on every pull request that's opened, synchronized, or reopened — the PR scan runs against its head ref. You can also kick off a scan by hand from the dashboard. Each connected repo is wired up with a GitHub webhook, so once it's connected you don't have to do anything to keep it covered. There's no scheduled or cron-based scanning today; scans are push, PR, or manual only.

SAST runs on JavaScript, TypeScript, Python, Go, Java, and Ruby via Semgrep. Dependency CVE scanning (Trivy plus Google's OSV) covers npm, pip/PyPI, Go modules, Cargo, RubyGems, Maven, and more, with ecosystem-aware upgrade commands. We also scan Dockerfiles, docker-compose, Kubernetes, Terraform, and CloudFormation for IaC misconfigs, plus OpenAPI/Swagger specs for API-security issues. Auto-push fixing, however, currently lands only for npm dependencies — the other ecosystems get a paste-ready fix instead.

Sign in with GitHub OAuth in one click — there are no personal access tokens to paste, and the sign-up consent covers ONLY your public profile and email address, nothing about your repositories. You pick a repo, get your free scan and score, and only when you start the trial does Patchhog ask for the repo grant it needs to install the scan webhook (and, if you use it, push the auto-fix commit). Until you approve that second GitHub screen, Patchhog cannot read a single private repo — and you can revoke either grant from GitHub's own settings whenever you want.

It commits straight to your default branch — no branch, no PR — authored under your own GitHub identity via your OAuth token, not a bot. It handles npm only: it bumps package.json ranges, pins in-range transitive vulns through an npm "overrides" entry, regenerates package-lock.json, and bundles every manifest in the repo into one atomic commit. Major-version bumps and out-of-range transitive deps are deliberately left for you. If branch protection blocks the push it fails cleanly and tells you to relax protection or merge by hand — it never silently downgrades to a PR.

On any open finding you can Mark fixed, Ignore, or flag it False positive — and Reopen later if you change your mind. Dismissals stick: when the same finding turns up on a later scan, Patchhog matches it by fingerprint and carries your Ignore or False-positive status over so it doesn't resurface as open. Only your most recent decision per finding is honored, so a Reopen stops the suppression on the next scan. For pattern-based SAST and IaC rules there's also an "Ignore all like this" action that silences every open hit from that rule at once.

Findings use five levels — critical, high, medium, low, and info. Leaked secrets and known-malicious packages are always rated critical; typosquats are high. We also tune the noise: a non-critical dependency CVE with under a 0.1% 30-day exploitation probability (EPSS, from FIRST.org) is dropped one step, and a vuln that's only reachable through a dev dependency is dropped one step too. The aim is that what shows as critical or high is genuinely worth your attention.

Because two engines run for dependencies, the same CVE reported under different IDs is collapsed by computing a canonical ID (CVE first, then GHSA) and fingerprinting on package, version, and that ID. A secret caught by both Gitleaks and Semgrep is merged by file and line so it shows once, while distinct rules on the same line stay separate. When hits overlap we keep the most severe one. Findings from every engine land in a single normalized schema, so the dashboard isn't cluttered with the same issue twice.

Yes — there's a bundled CLI for local pre-commit hooks and CI. It's self-contained (Node standard library only) and never calls a Patchhog cloud API; its only network calls go to the public OSV API for dependency lookups, so it runs offline apart from those CVE checks. It flags hardcoded secrets, vulnerable dependencies across npm/PyPI/Go/Cargo/RubyGems, known-malicious and typosquatted package names, and dangerous npm install-script hooks. Use --json for machine output and --fail-on=<severity> to break the build when anything at or above your threshold is found.

No AI at all, on any tier — scanning and remediation are fully deterministic. Your source is never sent to or used to train any model, ours or anyone else's. The engines are battle-tested tools — Semgrep, Trivy, Gitleaks, Google OSV — plus Patchhog's own regex and JSON checks. Even the "Send to coding agent" button is just a clipboard prompt you paste into your own tool like Claude Code or Cursor; nothing leaves Patchhog to an LLM.

Not yet — Patchhog is a hosted SaaS for now. The scan worker runs off our own infrastructure with git and npm available alongside the bundled scanner binaries, separate from the web app, and each scan runs in an isolated job with a fresh per-scan temp directory that's wiped the moment it finishes — no repo working copy is mirrored or carried between repos. If you want something on your own machines today, the bundled CLI is self-contained on Node's standard library and never touches our cloud; its only network call is to Google's public OSV API for dependency-CVE lookups, so it's effectively offline for pre-commit and CI.

The cap counts every connected repository — 3 on Solo, 15 on Pro, unlimited on Business. If you downgrade and end up over the limit, you'll need to delete repos back down to the cap, and scans (including webhook-triggered ones) are held until you do. A push from a repo whose subscription is inactive, or whose owner is over the cap, is acknowledged but not scanned rather than failing the webhook delivery.