Evidence ledger for dev agencies
Prove your security maintenance, not just promise it.
Scanner output in - an evidence-backed record out. PatchLedger tracks every advisory from the vulnerability scans you already run, holds the fix and verification evidence against it, and prints the branded monthly report your clients can actually rely on.
no repo access / no tokens / no scanning / no AI in the data path
Paste the scanner output you already have
npm audit --json or osv-scanner --json, straight from your terminal. PatchLedger parses it deterministically - advisory-level dedupe, severity normalization, CVSS 3.1 vector scoring. No repository access, no tokens, nothing scanned.
Every advisory becomes an evidence record
Fixed means a PR, commit or release is on the record. Verified means a passing test or build run backs it. False positives and accepted risks stay visible with the reason, where your client can read them.
Ship the monthly proof, not a promise
A branded report freezes the state: what was fixed, what was verified with a passing run, what is still open and inside or past its SLA. Honest limitations printed on every page, because a report that overpromises is a liability.
Scope statement
What PatchLedger is not
- Not a scanner
- Dependabot, osv-scanner and Trivy scan for free. PatchLedger is the record that starts after the alert.
- Not an audit
- Reports state the scanner, the date and the scope - and say plainly they are not security certification.
- Not repo-connected
- Read-only by design: no GitHub app, no tokens, no PRs opened, no code uploaded anywhere.
- Not AI-generated
- Parsing, dedupe, SLA math and reports are deterministic. No customer data reaches a model.
Rates
Flat monthly. No per-seat metering.
billing disabled during pilot - free until then
Not ready to sign up?
Leave your email and we will reach out when the pilot opens for new agencies.