Skip to main content
PatchProof PatchProof

Security by architecture

Untrusted execution stays outside the control plane.

PatchProof separates orchestration from repository execution, uses scoped credentials at every boundary, and keeps deterministic evidence reviewable while reducing accidental secret exposure. Review logs and artifacts before upload: redaction cannot detect every secret.

Cloud plans and records.

Self-hosted runners execute.

Four explicit boundaries

Authority is separated before a run starts.

01

Cloud boundary

The Laravel cloud stores users, workspaces, projects, run plans, redacted logs, artifacts, and reports. It does not clone repositories, execute project commands, or receive a Docker socket.

02

Runner boundary

Self-hosted runners clone and execute code in per-run workspaces with time limits, bounded logs, explicit capabilities, and cleanup restricted to directories PatchProof created.

03

Credential boundary

Operator, invitation, runner, and per-job tokens are separate. API, runner and invitation tokens are stored as SHA-256 hashes; account passwords use separate password hashing. Keep issued plaintext tokens private.

04

Tenant boundary

Session and API access require a verified operator, current workspace, role authorization, and resource ownership checks. Cross-workspace identifiers return not found.

Trust boundary

Coordination in the cloud. Execution on your runner.

PatchProof keeps untrusted repository work outside the control plane while preserving a shared, reviewable proof.

  1. 01

    PatchProof Cloud

    Plans runs, matches runner capabilities, stores structured evidence with redacted logs, and enforces workspace access.

    • No repository execution
    • No Docker socket
    • Scoped orchestration tokens
  2. 02

    Self-hosted runner

    Claims the job, checks out authorized source, executes bounded commands, and redacts output.

    • Per-run workspace
    • Bounded time and logs
    • Customer-controlled network
  3. 03

    Reviewable proof

    Separates execution, risk, and verdict so the merge decision points back to concrete evidence.

    • Deterministic findings
    • Redacted logs, bounded artifacts
    • Commit and policy provenance

Security controls

Defence in depth around identity, jobs, and evidence.

Operator and workspace access

  • Verified email and throttled password recovery
  • Owner, Admin, Member, and Viewer permissions
  • Expiring, revocable workspace invitations
  • CSRF protection and secure session cookies
  • Tenant ownership checks with non-disclosing failures

Runner and job access

  • Separate operator, registration, runner, and job credentials
  • Hashed long-lived credentials
  • Short-lived per-run job tokens
  • Runner label and capacity matching
  • Monotonic step and run lifecycle validation

Presentation and transport

  • Security headers, trusted hosts, and HTTPS enforcement
  • Token-aware API and runner rate limits
  • Pre-upload and server-side log redaction
  • Bounded user-facing metadata
  • No operator credential shared with runner code

Evidence handling

  • Artifact path, size, content, and retention controls
  • Symlink and dependency-directory exclusions
  • Capped logs and report projections
  • Separate execution, risk, and verdict state
  • API health and database readiness boundaries

Shared responsibility

Runner operators still control the highest-risk boundary.

You are responsible for runner operating-system hardening, Git and package-registry credentials, network access, secrets, backups, and legal authority to process each repository. Use isolation appropriate for untrusted project commands and never expose a privileged Docker socket to the cloud control plane.

Review the terms

Report a security concern

Cameron Low operates patchproof.dev. Email hello@cameronlow.com with “PatchProof security” in the subject and a minimal description. Do not send secrets or another user’s data. Ask for an appropriate private transfer method if evidence is sensitive. Do not probe other workspaces, disrupt service, or retain accessed data. No paid bounty or blanket testing authorization is offered.