Security at Patchico
Last updated July 2026
Trusting a tool with write access to your code is a big deal. Here's how we earn it — with least-privilege access, isolation, and a human in the loop by default.
Scoped, least-privilege access
Patchico installs as a GitHub App on only the repositories you choose. It reads to analyze and writes only to branches it opens for review — it never pushes to your default branch.
Isolated execution
Every migration is generated and validated in an ephemeral, isolated sandbox. Environments are destroyed after each task and never shared between customers.
Encryption
Data is encrypted in transit (TLS 1.2+) and at rest. Secrets and tokens are stored in a dedicated, access-controlled vault.
We never train on your code
Your private source code is never used to train shared or third-party models.It’s used only to perform the task you requested, then discarded.
Human in the loop
By default, a developer reviews and merges every pull request. Every change is reviewable and trivially reversible.
Compliance
Our controls are aligned with SOC 2, and we support self-hosted runners for teams with stricter requirements.
Reporting a vulnerability
Found something? We’d love to hear from you. Email security@patchico.com — we aim to respond within 24 hours.