How PatchTempo works

We start by looking at what an attacker would see. With just your website address we can check what is publicly visible: software versions your server announces, TLS settings, security headers and the common services left open.

If you give us read-only access, the audit goes deeper: installed packages, your app's dependencies, framework versions, configuration files and how logins are set up.

• Known vulnerabilities (CVEs) that affect your exact versions
• Software that is out of date or no longer supported
• Risky settings, such as password logins over SSH or an open database port
• A ranked list: what to fix first, and why, in plain language

Most servers are months or years behind. We bring everything up to date once, in a documented upgrade: operating system packages, your app's dependencies and framework, and the configuration around them.

The easy doors get shut at the same time: SSH keys instead of passwords, services that should not be public closed, default settings tightened.

• Every change goes through a pull request and staging first
• Your app's tests run before anything reaches production
• A written record of what changed, so your developer is never surprised

New vulnerabilities are published every day. Most of them do not concern you. Our agents check each new CVE against the exact software and versions you run, and sort them by how much they matter for your setup.

Critical vulnerabilities that affect you are handled as soon as a fix exists, within the delay written in your contract. The rest goes into the monthly cycle.

Once a month, pending updates are prepared, tested on staging and proposed for approval. A person approves every merge and every reboot, then the change rolls out in your change window.

You get a dated report: what was found, what was fixed, what was tested, and anything waiting on you. It is written for owners, with a technical appendix for your developer.