Introduction
Patchlight reviews pull requests and scans whole codebases for security vulnerabilities. Findings show up where you already work.
Four ways in
Most teams start with the first two: a review on every pull request, and a scheduled scan of the whole codebase. Quickstart sets up both in about five minutes.
Add rate limit to signup
3Move invites to a queue
1Bump drizzle to 0.45
Cache workspace lookups
23 findingsworst first
No limit on signup attempts
42+ await limiter.check(ip)
ResolveDismiss
PR reviews
Every pull request gets a reviewer, with findings on the changed lines.
Scan schedule
DailyWeekdaysCustom
M
T
W
T
F
S
S
09:00 · Europe/BerlinScan on merge
Raw SQL in search endpointIssue #214
Security scans
The whole codebase, scanned on your schedule or after every merge.
~/acme-api $ patchlight scan --diff14 files changed · 2 findingscriticalToken logged on refresh auth.ts:88highOpen redirect in callback login.ts:21↑↓ move · r resolve · d dismiss
87 const token = await refresh(session)
88 log.info("refreshed", { token })
Your terminal
Scan your working tree before you push, uncommitted changes included.
buildtestpatchlight review
$ npx @patchlight/sdk review --wait --fail-on high
Reviewing 9 files against origin/main…
high Missing auth check on DELETE /invites routes.ts:64
1 finding at or above high · failing the job
Your CI
Review from GitLab, Bitbucket or Azure, and fail the job on severe findings.
Reviews and scans
| Review | Security scan | |
|---|---|---|
| Reads | the diff of one change | the whole codebase |
| Answers | Is this change correct and safe? | What is already wrong in here? |
| Typical cost | a cent or two | cents for a small library, dollars for a large monorepo |
| Findings carry | severity and category | severity, category and a CWE id |
Both land in the same findings list, and you triage them the same way.
What it costs
- Free to start. A new personal workspace gets its first 20 runs or $2 of usage, whichever comes first. Reviews and scans both count.
- Then pay for what runs. Top up from $10. No seats, no subscription.
- Set limits. A monthly spend cap per workspace, and a monthly budget per repository.
Good to know
- Workspaces. Your personal one, or an organization you create and invite teammates to. Each has its own repositories, balance and API keys.
- Your code. Never used for training, and deletable in one click.