Product walkthrough
Authorized snippets become attack-chain reports your team can patch.
Patchhound is built for modern SaaS teams that need to reason across Next.js routes, Supabase RLS, Clerk/Auth role mappings, Stripe billing paths, and tenant boundaries without running active tests.
Review chain: Acme Billing Portal
Non-invasive artifact review
Clerk role claim spoofed
Supabase RLS boundary bypassed
Invoice route exposes another org
Stripe refund route accepts forged actor
Patch checklist generated
Auth
metadata.role is treated as admin input.
Attacker can present an admin-shaped request context.
RLS
Policy checks role but not org_id.
Cross-tenant rows become reachable.
Route
/api/invoices/[id] fetches by invoice id only.
User retrieves another org invoice.
Billing
Route checks signed-in user, not invoice owner.
Refund action can cross org boundary.
Project setup
App URL context, stack selection, repo provider intent, and authorization attestation.
Artifact intake
Route snippets, RLS policies, auth mappings, Stripe notes, middleware, and business rules.
Analysis
Deterministic checks run before any reasoning over submitted artifacts.
Attack-chain map
Findings link auth, data, route, and billing assumptions into likely abuse paths.
Finding detail
Severity, confidence, evidence, reproduction reasoning, and fix checklist.
Follow-up
Implementation request and audit trail for review scope, report creation, and settings changes.