How can we help?

Getting access

How do I join my team in Patchd?

Ask one of your team’s admins to invite you. Patchd has no sign-up page, and only admins can invite people. Your invite comes by email, with a link that works once and lasts 7 days.

My invite link has expired or doesn’t work

Ask an admin to resend your invite. That emails you a new link, and the old one stops working. Links last 7 days, and each works only once.

My team doesn’t use Patchd yet

Request an invite to try it free for 7 days, with no credit card.

Signing in

Why do I need a passkey or an authenticator app?

Patchd shows where your organisation’s software is vulnerable, so everyone proves who they are with a second factor. Until you’ve added a passkey or set up an authenticator app, Patchd won’t show you anything. You can’t remove your last one.

I’ve lost my phone or my passkey

If you set up an authenticator app, you can sign in with one of its recovery codes instead. Otherwise, ask an admin to reset your sign-in methods. That removes your passkeys and authenticator app and signs you out everywhere, and you set up new ones the next time you sign in. Admins can’t reset their own, so an admin who’s locked out needs another admin to do it. If you’re the only admin, contact us.

I’ve forgotten my password

Reset it from the sign-in page. The reset link we email you lasts 60 minutes. If you sign in with only a passkey, you don’t need a password.

Your team

What can each role do?

• Admins manage people, connections and the audit log, and act on findings.
• Maintainers acknowledge, snooze or accept the risk of findings, and refresh repositories.
• Viewers see everything and change nothing.

There’s always at least one admin.

How do I change someone’s role, or remove them?

Admins can do both from Settings → Users. Every change is recorded in the audit log.

Can I delete my own account?

Not yet. Ask an admin to remove you, or contact us.

Connections and scans

What access does Patchd need?

Read-only access to your repositories, through a token:

• On GitHub, a fine-grained personal access token. Classic tokens are turned down.
• On GitLab.com, a token with the read_api scope and only read scopes. Tokens that could change anything are turned down.

Tokens are stored encrypted, and never shown again once they’re saved.

How often does Patchd check my repositories?

Every 15 minutes. It looks for new repositories every hour, and scans a repository as soon as you start monitoring it.

What does Patchd read, and what does it keep?

It reads the list of files in each repository to find its lockfiles and Dockerfiles, and reads those. It keeps the names and versions of the packages in them, with the files’ paths, but not the files themselves, and it doesn’t read the rest of your code.

How do I stop watching a repository, or remove a connection?

Admins can stop monitoring a repository, which keeps its findings, or remove a whole connection, which deletes its token, its repositories and their findings from Patchd. The token still works on GitHub or GitLab until you revoke it there, so revoke it there too.

Billing

How does the free trial work?

It lasts 7 days and is free, with no card details needed. To keep using Patchd after it, subscribe. Ourpricing page has the prices, and our terms the details.

How do I cancel, or get a receipt?

The terms explain cancelling and refunds. For anything else about billing,send us a message.

Privacy and security

How do I report a security issue?

Send us a message about what you found. Please keep the details to yourself until we’ve fixed it.

How do I get a copy of my data, or have it deleted?

Ask your organisation’s admins, or contact us. Ourprivacy policy explains your rights.

Still need help?

Send us a message, and we’ll reply by email.