P PatchPilot
Request access

Works with the scanners you already run

Security alerts in. Tested pull requests out.

PatchPilot reads findings from SAST, dependency scanners and pentest reports, writes a minimal fix, runs your test suite against it, and opens a pull request your team can review.

Free tier for open-source maintainers and early-stage startups.

Beta target: time to patch
under 2 min
Every PR includes
test results
Code retained
none
Merging
always human

Try a remediation

Pick a finding, then run it. This demo replays example output; it does not scan your code.

    
          
    
        
    
      
    
    
    
  
    

    


    
  
    
    
    From alert to review in three stages
    
    
    Nothing reaches your main branch without a person approving it.
    
    
      
      
    1. Step 1
      Read the finding
      Accepts SARIF files and CVE advisories from your CI webhooks, then traces the tainted data from source to sink through your code.
      2. 
      
    2. Step 2
      Write a small fix
      Generates the narrowest change that removes the vulnerability, keeping your naming, scoping and surrounding logic intact.
      3. 
      
    3. Step 3
      Prove it, then open the PR
      Builds in an isolated container, runs your tests, re-runs the scanner on the change, and attaches the results to the pull request.
      4. 
    
    
  
    

    


    
  
    
    
    Fits the workflow you have
    
    
    Integrations are in active development; availability may vary during the beta.
    
    
      
      
    • GitHub ActionsWorkflow step
      • 
      
    • GitLab CIPipeline job
      • 
      
    • SemgrepSARIF import
      • 
      
    • SnykWebhook
      • 
      
    • SonarQubeIssue import
      • 
      
    • Jira, SlackStatus updates
      • 
    
    
  
    

    


    
  
    
    
    Built for code you cannot share
    
    
    
      
    No code retention
    Source is held in memory for the job and deleted after the pull request opens. It is never used for training.
    
      
    Isolated verification
    Generated changes build and test inside sandboxed containers with no access to your secrets or network.
    
      
    Self-hosted option
    Run the orchestrator inside your own VPC or an air-gapped Kubernetes cluster.
    
    
    
  
    

    


    
  
    
    
    Questions
    
    
    
  
    

    


    
  
    
    
    Clear your security backlog
    
    
    Join the private beta and get sandbox credentials for one repository.
    
    Request access