Patchwire

Vulnerability scanning for the rest of us.

Connect a repository, get a signed report. Self-hosted, multi-tenant, API-first.

🔎

Two scanners out of the box

Semgrep for SAST, Gitleaks for secrets. Findings deduplicated and severity-summarised before they hit your dashboard.

🪝

Forgejo, GitHub, GitLab, and Bitbucket Cloud. HMAC-signed deliveries trigger a scan in under a minute.

🔒

Per-project access tokens stored under AES-256-GCM. Plaintext never returned over the API; never written to logs.

📄

Every scan has a printable report — drag into a Slack thread, attach to a ticket, ship to compliance.

🌐

English and Arabic, RTL where it matters. Add another language by dropping a folder into the docs site.

🛠

Every UI action is a documented HTTP endpoint. Open API reference at api.patchwire.app/docs.