Security

For Symbiote Mirror Pass engagements, we request the minimum GitHub permissions required to read your repository and open a single pull request: Contents: Read and Pull requests: Write. No admin scope, no webhook creation, no secrets access. A fine-grained Personal Access Token scoped to the target repository is the recommended credential format. Credentials are revoked immediately after the PR is delivered and confirmed received.

Patchward runs entirely within your own environment — you install the CLI (uv tool install patchward), configure it with a .env file in your project root, and it scans, fixes, and opens pull requests locally. Static-analysis scanning happens in a Docker sandbox with default-deny network egress — most scanners (Semgrep, Bandit, ESLint, Trivy, OSV-Scanner) run fully offline, and pip-audit/npm-audit get a narrow, allowlisted exception to reach PyPI and the npm registry for vulnerability-database lookups. The triage and fix-generation stages, however, call the Anthropic API directly from your environment and read file contents from your repository to do their job — see Inference layer below for what that involves. The GitHub token you supply requires Contents: Read+Write and Pull requests: Write on the target repository only. All credentials are loaded from environment variables — they are never hard-coded, logged, or transmitted to CallMed AI.

Both products use the Anthropic API exclusively — no code is processed via OpenAI or any other model provider. For Symbiote, file contents pass through the API to generate type annotations. Patchward calls the Anthropic API at two stages: a triage pass that reviews scanner findings and may read additional files for context, and a fix-generation pass that is instructed to read the relevant file before editing or declining a fix. Both stages can read any file within the scanned repository, not only the flagged lines — a deliberate design choice so the model has enough context to produce a correct fix, not an oversight. By default, Anthropic does not retain API inputs or outputs for training purposes. Customers requiring a formal Zero Data Retention agreement should request one before engagement.

The Patchward CLI enforces a credential isolation boundary specifically around Docker-sandboxed scanner containers: API keys and GitHub tokens are loaded once into a CredentialProxy, structurally excluded from every container's environment variables, and checked again by a hard runtime assertion before each container starts. The boundary is drawn at the container, not at the scanner binaries themselves — Semgrep, Bandit, and the rest are version-pinned tools baked into a maintained image — because it's the target repository's own content that those tools read directly, and our security test contract for this layer treats that content as potentially adversarial: test cases include a fake credential string and a destructive-command-shaped comment embedded in scanned source, confirming neither can reach a credential or escape the container. Git operations are held to a different standard because they do a different job: pushing already-committed content to a remote, not interpreting untrusted content the way a scanner does. Git legitimately needs the GitHub token to authenticate that push, and receives it deliberately — embedded in the HTTPS remote URL passed as a command argument — rather than through an inherited environment variable, though like any subprocess without an explicit environment override it does inherit the parent process's full environment otherwise. Scanner finding messages (from Semgrep, Bandit, and the other static analysis tools) are scrubbed of Patchward's own credential values to [REDACTED] before being written to logs or displayed in CLI output; text generated by the triage or fix-generation LLM stages is not covered by this scrubbing.

All mutations are written to dedicated isolated branches — symbiote/plan-{id} for Symbiote and patchward/fix-<finding-id> for Patchward. We never push to main or any protected branch. Worst-case rollback is a single git branch -D. The branch naming convention makes the source of every automated commit unambiguous in your git history.

Every fix generated by Patchward passes a deterministic three-gate pipeline before a PR is opened. Gate 1: the scanner re-runs and must confirm the original finding is no longer present. Gate 2: the diff must fall entirely within the vulnerability's declared line bounds — no out-of-scope edits are permitted. Gate 3: the project's test suite must pass. A fix that fails any gate is discarded and never reaches a pull request. Each session produces a structured run log recording which findings were attempted, which gate (if any) failed, and the final outcome — this log is status metadata only; it does not capture the content of what was sent to or received from the Anthropic API.

Every lock acquire, wait, release, and denial is logged with monotonic-nanosecond timestamps to kernel.log. A verdict line (COLLISION-FREE ✓ or COLLISION DETECTED ⚠) is appended at the end of every run. The log is delivered alongside the PR so your team can independently verify the execution trace.

All connections between the CLI and the Anthropic API, and between the CLI and the GitHub API, are made over TLS 1.2 or higher. callmedai.com is served exclusively over HTTPS with HSTS enforced. No credentials or code are transmitted over unencrypted channels.

Patchward dependencies are pinned in uv.lock and verified against a lock file on every install. We do not pull from untrusted or private registries. The Patchward package is published to PyPI under the patchward namespace. Customers with strict supply chain requirements can audit the lock file and vendor dependencies before installation.

We sign mutual NDAs before receiving access to any non-public repository under a Symbiote engagement. A Data Processing Agreement (DPA) under Art. 28 GDPR is available on request. Patchward customers operating fully on-premise have no data processed by CallMed AI — contact us to confirm what agreements are appropriate for your situation.

Found a vulnerability in our products or infrastructure? Contact yehor@callmedai.com with a description of the issue, affected component, and reproduction steps. We aim to acknowledge within 48 hours and resolve critical issues within 7 days. We do not pursue legal action against good-faith security researchers.