PatchPilot
Find vulnerable packages in code and on servers, and get one command that fixes them.
Every application and server runs hundreds of open source packages, and new vulnerabilities in them are published daily. PatchPilot reads lockfiles and Linux package lists, checks every package against OSV.dev, removes duplicate advisories, puts actively exploited bugs first and produces a fix plan with the lowest safe version and a ready upgrade command. A small open shell agent covers servers, which code-repository tools like Dependabot do not.
- Stage
- Live beta, free
- Launch market
- Developers, agencies and hosting providers
- Revenue
- Monthly subscription per project and server
- Price
- Planned 490 to 1.990 kr a month
- Buyer
- CTOs, lead developers, IT operations
- Stack
- PHP · SQLite · OSV.dev · shell agent
The problem
- Outdated dependencies are behind many breaches, from Log4Shell to the Equifax Struts hole.
- Dependency tools want access to the code repository, which many agencies and clients will not grant.
- Nobody tracks the OS packages on the servers that run the code.
The product
Upload or paste any of 12 formats (package-lock.json, yarn.lock, composer.lock, requirements.txt, Pipfile.lock, Gemfile.lock, Cargo.lock, go.sum, go.mod, package.json, dpkg -l, rpm -qa), or run the agent, which sends only package names and versions with the OS release. PatchPilot batches the lookup against OSV, merges GHSA, PYSEC and distro duplicates by CVE, scores with CVSS v3, flags CISA KEV and writes one upgrade command per ecosystem.
- Paste a lockfile on the homepage for a free audit.
- Create an account to keep history per project.
- Put the agent in cron on each server for a daily audit.
- Run the suggested upgrade command.
- Audit again and watch the grade go to A.
Who pays and why
Business model
| Revenue line | Price | Notes |
|---|---|---|
| Free | 0 kr | 20 audits a day, all formats, share links. |
| Business | 490 kr a month (planned) | 25 projects or servers, daily agent audits, alerts. |
| Partner | 1.990 kr a month (planned) | Unlimited, white-label reports, API. |
Market and targets
Software composition analysis is a large and growing market led by Snyk, GitHub Dependabot and Mend, all built around code repositories. The server side and repository-free use are poorly served for small teams, and EU rules like the Cyber Resilience Act push vendors to track component vulnerabilities.
Targets and prices are planning assumptions. Payments are not switched on yet.
Go-to-market
Free audits
- Paste and upload audits live (done)
- Agent for 5 Linux families (done)
- SEO pages per ecosystem
Teams
- Email and Slack alerts on new CVEs in audited packages
- CI step for GitHub and GitLab
- Payments
Compliance
- SBOM import (CycloneDX, SPDX)
- Evidence export for ISO 27001 and CRA
- License checks
Channels
| Developers and SEO | Searches for how to check a lockfile for vulnerabilities. |
|---|---|
| Agencies | Show clients a monthly patch report. |
| Hosting partners | Offer the agent to every server customer. |
Competition
| Alternative today | Why we win |
|---|---|
| GitHub Dependabot | Free and good, but only for code on GitHub and not servers. |
| Snyk, Mend | Strong, but priced and built for larger teams. |
| OSV-Scanner, Trivy | Free command-line tools without history, sharing or a fix plan for non-experts. |
What we measure
- Packages audited per week
- Agents reporting daily
- Vulnerable packages fixed between audits
- Trial to paid conversion
Status and roadmap
- Parsers for 12 lockfile and package-list formats
- OSV batch lookup with parallel advisory fetch and caching
- Duplicate removal by CVE, CVSS v3 scoring, KEV escalation
- Fix plan with lowest safe version and per-ecosystem commands
- Open shell agent for dpkg, rpm and apk with API key
- One login across PortWarden, SiteSentry and PatchPilot
- Ownership proof by DNS TXT or /.well-known file before intrusive scans
- Queued scan workers, live progress, A to F grading with a 100-point score
- Share links, JSON export, print-to-PDF reports, new / fixed diff against the previous scan
- Scheduled daily or weekly rescans, daily refresh of the CISA KEV catalogue
- Installable PWA, demo account, rate limits and private-network blocking
- Alerts when a new CVE hits an already audited package
- CI integration
- SBOM import
- Payments and plans
Risks
| Risk | How we handle it |
|---|---|
| Distro package naming mismatches | The agent sends source package names and the OS release for exact matching. |
| Customers wary of sending data | Only names and versions leave the server; the agent is 20 readable lines. |
| Free tools are good enough for experts | The target is teams without a security engineer. |
Want a product like this?
We build version one of products like PatchPilot from about $3,000: web app, admin panel, mobile app and API, live on your own domain. Then we can host and maintain it for $500 a month.