Legal
Terms of Service
1. Who we are
These terms are between you and PatchAndShip, based in California, USA. "We", "us" and "our" mean PatchAndShip. You can reach us at patchandship@gmail.com.
By placing an order or requesting a free mini check, you agree to these Terms, our Refund Policy and our Privacy Policy.
2. Who can use PatchAndShip
You must be at least 18 years old to use our services. We work with both individuals and businesses.
3. What we do (scope)
We fix critical security issues in web apps and, on plans that include it, deploy them to production. What's included is our published checklist:
- Row Level Security (RLS) disabled or wide open
- Public storage of private files
- Exposed secret keys (client bundle or repo)
- Secrets under public env prefixes; SECURITY DEFINER leaks
- Misconfigured environment variables or auth redirects
- On Node/Express apps: missing server authz, open CORS, hard-coded secrets, publish bind mistakes
- Deployment, on plans that include it
The checklist issues are what we mean by "critical". Anything else is out of scope unless we agree to it in writing. "Live" means deployed on the host you choose. If you use a custom domain, its DNS settings depend on you.
4. Your authorization
You must own the app you submit, or have the authority to give us access to it. By placing an order or requesting a mini check, you confirm this and you consent to us scanning the app and, for paid work, making changes to it.
We revoke our access to your systems when we hand the work back to you.
5. Access
We use least-privilege access: collaborator or member invites and scoped tokens, with only the minimum access needed. Never send us your account passwords. We will never ask for them.
6. Best-effort service and no other warranties
Our service is best-effort. It is not a penetration test, a guarantee of security, or a compliance certification. We cannot promise that your app will be free of every vulnerability after we finish.
Apart from the 48-hour guarantee below, the service is provided "as is", with no other warranties, express or implied, to the extent allowed by law.
7. The 48-hour guarantee
If we don't fix the critical issues and get your app live within 48 hours of receiving working access, you get a full refund. The 48 hours count from when we receive working access, and the clock pauses while we are waiting on you. The full conditions, and how to claim a refund, are in our Refund Policy. The Launch Pack and the monthly plan are not covered by the 48-hour guarantee.
8. Prices and payment
- You pay the prices listed on our site, in US dollars.
- Payments are processed by Stripe. Sales tax is added where required by law.
- The monthly plan renews each month until you cancel. You can cancel anytime by emailing patchandship@gmail.com. Cancellation takes effect at the end of the current billing period, and we do not give partial refunds.
9. Your intellectual property
You keep all intellectual property in your app, including the fixes we make to it.
10. Confidentiality
We keep your code, data and credentials confidential and use them only to deliver the service.
11. Limitation of liability
To the fullest extent permitted by law, our total liability to you for any claim related to our services is limited to the fees you paid us.
12. Indemnity
You agree to indemnify us against claims that arise because you submitted an app you don't own, or gave us access you weren't authorized to give.
13. Governing law and venue
These Terms are governed by the laws of the State of California. Any dispute will be handled in the courts of Ventura County, California.