Behavioral analysis
Detects unexpected publisher changes, unusual publish timing windows, and anomalous file additions that deviate from historical patterns.
Stop malicious patches before they reach production
PatchGate catches supply chain attacks at the moment of publish—not after deployment. Real-time behavioral analysis flags suspicious maintainer activity, timing anomalies, and credential-harvesting signatures before risky patches enter your CI/CD.
Request early accessWhy patches slip through today
Teams audit major version bumps carefully. Patch releases? They're rubber-stamped. That's where attackers hide—in the noise of routine updates. One compromised maintainer account, one typosquatted dependency, one credential harvester masquerading as a legitimate fix, and your pipeline is compromised.
How PatchGate works
Signature detection
Identifies known credential-harvesting and exfiltration patterns in patch code before it's installed.
Real-time gating
Integrates with npm, PyPI, and GitHub Actions to block or flag risky patches in milliseconds—no pipeline delays.
Supply chain context
Maps publisher reputation, registry provenance, and dependency relationships to surface risk in your exact dependency tree.
Built for high-velocity teams
If you're managing thousands of dependency updates per week across dozens of repositories, PatchGate is designed to scale without adding friction. Automated threat intelligence feeds keep behavioral models current. Custom policy rules let you enforce your security posture, not a vendor's.
What's included
Patch-level threat detection
Behavioral analysis of publisher patterns, timing, and file changes—not generic provenance scoring.
GitHub Actions integration
Gate patches in your CI/CD pipeline. Block, flag, or auto-remediate based on risk level.
Multi-registry support
Monitor npm, PyPI, and private registries with unified policy enforcement.
Audit & compliance
Full visibility into which patches were flagged, why, and what action was taken—for SOC 2 and regulatory reviews.
Pricing tiers
Starter: 5 repositories, 100K pipeline executions/month. Growth: 50 repositories, 1M executions, custom policies. Enterprise: Unlimited repos, dedicated threat feeds, custom rules. See all plans
How does PatchGate differ from dependency scanning?
Dependency scanners check installed packages against known CVE databases—they catch known vulnerabilities post-deployment. PatchGate analyzes patch-release metadata and publisher behavior in real-time, at publish-time, to catch zero-day supply chain attacks before they're even installed.
Will PatchGate slow down my CI/CD pipeline?
No. Analysis happens at registry publish-time, not in your build. By the time a patch reaches your pipeline, the gate decision is cached. We're designing for sub-100ms decision latency.
Can I set custom policies?
Yes—on Growth and Enterprise tiers. Define rules for allowed publishers, time windows, file types, and risk thresholds. Policies sync across all repositories.
What registries do you support?
We're launching with npm and PyPI. Private registries and additional package managers are on the roadmap for Q2.