Patch fixes it. You review the pull request.
Your report says what's wrong. Connect GitHub and Patch, the ShipPatrol raccoon, opens pull requests that fix it in your code: headers, cookie consent, SEO, accessibility and vulnerable packages. He never pushes to your main branch.
How it works
- 01 · Connect
Install the app on one repository
From your report, choose "Fix it for me on GitHub" (or "Connect GitHub" on Patrol). GitHub asks which repositories ShipPatrol may see. Pick the one your site is built from.
- 02 · Fix
Patch makes the changes and builds
He clones the repository into a temporary folder, works out your framework and host, makes each fix, and runs your build. A fix that breaks the build is taken out and listed for you instead.
- 03 · Review
You get pull requests, grouped by kind
Each one explains what changed and why, how to test it, and what to double-check. Merge when you're happy. Patrol keeps one open pull request per kind of fix and updates it rather than piling up new ones.
What the app can touch
- Contents: read and write, on the repositories you choose, to make the branch.
- Pull requests: read and write, to open and update ShipPatrol's own pull requests.
- Metadata: read, which every GitHub App has: repository names and default branches.
No workflows, no actions, no secrets, no administration, no issues, no access to your account. Patch never edits CI files, .env files or lockfiles by hand.
How we keep it safe
- Tokens are minted for each run, last an hour at most and are scoped to one repository. We never store them.
- Changes go on
shippatrol/fixes-…branches. Your default branch is never pushed to. - Your code is deleted when the run ends. We keep the repository name and the pull request links.
- Your project's own install and build scripts run in a separate, unprivileged sandbox user with none of our credentials.
- With the one-off add-on, the app is removed from your account straight after the run. With Patrol, disconnect any time from your dashboard or uninstall it on GitHub.
What it costs
Patrol ($29/month) includes automatic fix pull requests: when a scan finds something new it can fix, or a new vulnerability affects one of your packages, Patch opens or updates a pull request. A push to your default branch also re-scans the site, so it works as a deploy hook. One-off: add "Fix it for me" to a $19 full report for $9, for one batch of pull requests.
Questions
- What can ShipPatrol fix with a pull request?
- Security headers (in vercel.json, netlify.toml, _headers, staticwebapp.config.json, firebase.json or next.config), SEO basics (title, description, lang, Open Graph tags, robots.txt and a sitemap), a cookie banner that blocks trackers until visitors accept, a draft privacy policy, alt text and labels, vulnerable dependencies (within the same major version), secret keys in client code, and a row-level security migration for Supabase. Anything it can't do safely is listed in the pull request as "needs a human".
- Which repositories can ShipPatrol see?
- Only the ones you pick when you install the app. GitHub lets you choose "Only select repositories", and we recommend it: pick the one repository your site is built from.
- What permissions does the app ask for?
- Read and write access to code (contents) and pull requests, plus read-only metadata, which every GitHub App has. It does not ask for workflows, actions, secrets, administration, issues or anything on your account.
- Does ShipPatrol push to my main branch?
- Never. Every change goes on a branch called shippatrol/fixes-<date> and arrives as a pull request. Nothing reaches your site until you merge it.
- Does ShipPatrol keep a copy of my code?
- No. Each fix run clones your repository into a temporary folder, makes the changes, opens the pull requests and deletes the folder. We store which repository is connected and the links to the pull requests, nothing else.
- How long does ShipPatrol have access?
- With the $9 "Fix it for me" add-on, for one run: when the pull requests are open, we uninstall the app from your account ourselves. With Patrol, until you disconnect, uninstall the app on GitHub, or your plan ends. Access tokens are minted for each run, last an hour at most, and are never stored.
- Will a pull request break my site?
- Patch installs your dependencies and runs your build with each change. If the build fails, he takes that change out and tells you. Still, review each pull request and check the preview deploy before you merge, like any change.
- Is the cookie banner or privacy policy legal advice?
- No. ShipPatrol is not a law firm. The banner follows the guidance the report cites, and the privacy policy is a draft written from what the scan saw, clearly marked for you to review and complete.
Start with a free scan.
GitHub fixes start from a report. Scan your site, then fix it from there.