Request an invite
NewAct on findings, with an audit log of every decision

Every dependency,
checked every 15 minutes.

Patchd reads the lockfiles and Dockerfiles in your GitHub and GitLab repositories, then tells Microsoft Teams, Better Stack and your inbox the moment a package is vulnerable, out of date or past its end of life.

Request an inviteSee how it works
  • Read-only access to your repositories
  • A passkey or authenticator app for everyone
  • Composer, npm, Python and Docker
Every scan checksOSV.devCISA KEVendoflife.datePackagistnpmPyPIDocker Hub

What it finds

Five ways a dependency becomes a problem, in one list.

A CVSS score is only part of the story. A package that’s being exploited, past its end of life, abandoned or years out of date needs fixing too, and every finding says which version gets you there.

  • CriticalHighMedium

    Vulnerable

    Every package is matched against OSV.dev on every scan, even when the code hasn’t changed, because new advisories land on old versions.

    lodash 4.17.15 → 4.17.21
  • KEV

    Known exploited

    Anything on CISA’s catalogue of known exploited vulnerabilities goes to the top of the list, whatever its score.

    facade/ignition 2.5.1 → 2.5.2
  • End of life

    End of life

    Runtimes, frameworks and Docker base images that no longer get security fixes, with dates from endoflife.date.

    php:8.1-fpm · ended 31 Dec 2025
  • Abandoned

    Abandoned

    Packages their maintainers have walked away from, with the replacement they point to.

    swiftmailer/swiftmailer → symfony/mailer
  • 3 majors behind

    Falling behind

    Direct dependencies two or more major versions behind, flagged before an upgrade turns into a rewrite.

    laravel/framework 10.48 · latest 13.x

How it works

Connect once. It keeps watching.

Add a read-only token, choose the repositories to watch, and everything after that runs on its own.

  1. 1

    Connect GitHub and GitLab

    Add a GitHub organisation with a fine-grained token that can only read contents, or a GitLab group with a read_api token. New repositories are picked up every hour.

  2. 2

    Every lockfile, found

    It reads each lockfile and Dockerfile on the default branch, monorepos included, and only downloads the files that changed since it last looked.

  3. 3

    Checked every 15 minutes

    Each scan opens findings for new problems and resolves the ones you’ve fixed, so the list only ever shows what needs doing now.

Reads these files

  • Composer
    composer.lock
  • npm, Yarn and pnpm
    package-lock.jsonyarn.lockpnpm-lock.yaml
  • pip and Poetry
    poetry.lockPipfile.lockrequirements.txt
  • Docker
    DockerfileFROM base images

Alerts

Alerts where your team already looks.

Critical and High findings, and anything being actively exploited, alert straight away. Everything else waits for the daily digest. Each finding alerts once, so nobody learns to tune it out.

  • Microsoft Teams

    An Adaptive Card in the channel you choose, with the version that fixes it and a link to the advisory.

  • Better Stack

    An incident for each Critical or exploited finding that resolves itself when the fix lands, and a heartbeat after every scan.

  • Email

    Alerts to your list as they happen, and a digest at the time of day you choose.

Microsoft Teams · #security
Patchd10:45
Critical vulnerability in facade/ignition
CriticalKEV
Repository
acme/billing-api
Installed
2.5.1
Fixed in
2.5.2
Advisory
CVE-2021-3129
Open findingView advisory
Better Stack
facade/ignition 2.5.1 in billing-api
Incident opened at 10:45
Critical
2.5.2 reached main
Incident resolved itself at 11:30
Resolved
Heartbeat
After every successful scan

Triage

Decide what happens next, and keep the record.

Acknowledge a finding, snooze it for 7 or 30 days, or accept the risk with a reason. Snoozed findings come back on their own, and fixed ones resolve at the next scan.

  • Act from the overview, a repository or the findings list
  • A reason recorded with every accepted risk
  • Every decision in the audit log, with who made it and when
  • Viewers see everything and change nothing

Free trial

Try it free for 7 days.

Connect your GitHub and GitLab repositories and see what needs fixing before you pay anything.

  • A week of scans

    Long enough to see new advisories land on the versions you run.

  • No credit card

    You won’t be asked for card details to start your trial.

  • No commitment

    When the 7 days are up, you decide whether to carry on.

See what needs fixing today.

Bring a read-only GitHub or GitLab token. The first scan takes seconds, and the overview fills in as soon as it’s done.

Request an inviteContact us