-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathabout.html
More file actions
113 lines (104 loc) · 5.12 KB
/
Copy pathabout.html
File metadata and controls
113 lines (104 loc) · 5.12 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Method · Patchhound</title>
<meta name="description" content="The five-level gate every Patchhound fix passes before you see it: reproduce, discriminating tests, live verification, blast radius, hostile read.">
<link rel="preconnect" href="https://fonts.googleapis.com">
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Public+Sans:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;700&display=swap" rel="stylesheet">
<link rel="stylesheet" href="/style.css">
</head>
<body>
<header class="site"><div class="wrap">
<a class="brand" href="/">
<span class="brandmark">P</span>
<span class="brandname">Patchhound<span class="brandtag">We hunt · we patch · you sleep</span></span>
</a>
<nav class="main">
<a href="/">Free scan</a>
<a href="/hunt-log.html">Case files</a>
<a href="/services.html">Services</a>
<a href="/about.html" class="here">Method</a>
<a href="mailto:hello@patchhound.dev">Contact</a>
</nav>
</div></header>
<div class="wrap">
<div class="crumb"><a href="/">Home</a> / method</div>
<section class="hero" style="padding-top:28px;display:block">
<h1>A fix isn't done when it looks right.<br>It's done when it's proven.</h1>
<p class="lede">Every Patchhound fix passes the same five-level gate, paid client work and free open source patches alike. If any level fails, the work doesn't ship. This page is the whole gate; there's no hidden extra step for paying customers.</p>
</section>
<div class="secline"><span class="tab">The five levels</span></div>
<section class="block">
<ol class="gate">
<li>
<h3>Reproduce</h3>
<p>We never fix from assumption. The bug gets reproduced first, against the real system. If we can't reproduce it, we tell you that instead of shipping a guess.</p>
</li>
<li>
<h3>Discriminating tests</h3>
<p>A test that can't fail is decoration. New tests must fail on the broken code before they're allowed to pass on the fixed code. Both numbers go in your report. From our first case file: <strong>1 of 3 tests passed unpatched, 3 of 3 patched.</strong></p>
</li>
<li>
<h3>Live verification</h3>
<p>The actual server gets hit with actual requests. Blocked-before and working-after are demonstrated, not asserted. When something fails unexpectedly, we suspect our own test script before blaming the application. That rule has already saved us once.</p>
</li>
<li>
<h3>Blast radius</h3>
<p>The full relevant test suite runs, pre-existing failures get baselined so nothing is blamed on the wrong commit, other callers of changed code get checked, and the diff is scanned for secrets before anything leaves the building.</p>
</li>
<li>
<h3>Hostile read</h3>
<p>The finished diff gets reviewed as if by a skeptical stranger deciding whether to trust it. Unexplained choices get explained or removed. The report shows evidence with numbers, not adjectives.</p>
</li>
</ol>
</section>
<div class="secline"><span class="tab">Principles</span></div>
<section class="block faq">
<dl>
<dt>Evidence over claims.</dt>
<dd>Every statement we make about your site traces to a command run this session. We don't fabricate results, ever. A fabricated pass is worse than an honest fail.</dd>
<dt>Show our work.</dt>
<dd>The hunt log publishes what we find in open source, including mistakes. It keeps us honest and lets you judge our quality before paying.</dd>
<dt>Least privilege.</dt>
<dd>We ask for the minimum access needed and tell you exactly what we're asking for and why. No broad credentials, no "we'll figure it out as we go."</dd>
<dt>Skip beats slop.</dt>
<dd>A rejected engagement costs less than an embarrassing deliverable. We say no to work we can't verify properly.</dd>
</dl>
</section>
<section class="contact-band">
<div>
<h2>See the gate applied.</h2>
<p>Case file No.001 walks a real fix through all five levels, including the step where our own test script was the bug.</p>
</div>
<a class="btn solid" href="/blog/001-bounty-farm.html">Read case file No.001</a> <a class="btn quiet" href="/services.html">See the engagements</a>
</section>
</div>
<footer class="site"><div class="wrap">
<div class="cols">
<div>
<div class="fbrand">Patchhound.</div>
<div class="ftag">We hunt · we patch · you sleep</div>
</div>
<div class="fcol">
<strong>Site</strong>
<a href="/">Free scan</a>
<a href="/blog/">All case files</a>
<a href="/services.html">Services</a>
<a href="/about.html">Method</a>
</div>
<div class="fcol">
<strong>Evidence</strong>
<a href="https://github.com/iamwhitehat">GitHub</a>
<a href="/feed.xml">RSS</a>
</div>
<div class="fcol">
<strong>Contact</strong>
<a href="mailto:hello@patchhound.dev">hello@patchhound.dev</a>
</div>
</div>
<div class="legal"><span>Patchhound — evidence-based security studio</span><span>© 2026 · NL</span></div>
</div></footer>
</body>
</html>