SECURITY

Small blast radius. Verifiable outcomes.

The controls that protect your repositories and data during the PatchFlow private pilot, and the limits of what we commit to.

Last reviewed 26 September 2026 · Private-pilot scope

Access and identity

  • Invite-gated GitHub OAuth identifies the human; it does not authorize a repository.
  • A separate GitHub App installation is the repository grant boundary.
  • Installation and repository grants are rechecked before work and spend.
  • Sessions use signed, expiring, Secure, HttpOnly, SameSite cookies.
  • Managed-agent provider credentials are held in encrypted secret storage and are never entered by customers.
  • With the customer-hosted runner, your model key stays in your GitHub repository secrets; PatchFlow never receives it.

Migration safety

  • All pull requests are drafts; PatchFlow has no merge path.
  • Required GitHub Checks are named before launch and evaluated on an immutable head SHA.
  • CI definitions and GitHub Actions are forbidden agent-edit paths by default.
  • Retries, concurrency, attempts per version, and changed-file count are bounded.
  • Your own required GitHub Checks are the verification boundary; PatchFlow does not run your tests on its own infrastructure.

Infrastructure

Primary AWS regionap-southeast-2 · Sydney
Data at restEncrypted
Backups7-day automated retention
Application logs30-day retention
Webhook payloads90-day bounded retention
TLSHTTPS at public endpoints

Pilot limits

  • No SOC 2, ISO 27001, IRAP, or penetration-test certification is claimed.
  • The private pilot is suited to non-critical repositories and is not authorised for regulated data.
  • There is no uptime or high-availability commitment during the pilot.
  • Test output excerpts are truncated, not perfectly redacted; keep secrets out of test logs.
  • With the managed agent, the coding agent has a separate GitHub integration that you grant and review separately. The customer-hosted runner needs none.
  • A detailed architecture and risk summary is available to pilot security reviewers on request.

Report a vulnerability

Email security@patchflow.run with the affected surface, reproduction steps, and impact. Do not access customer data, degrade service, or publicly disclose an unresolved issue. We acknowledge pilot security reports within one business day.