every patch tells a story vulnerability.

§00 — patch intelligence, from diff to PoC

Read the
patch.
Ship the
proof. // Self-hosted AI-powered patch analysis. GitHub repos, WordPress plugins, local code.

patchleaks.sh ◼ tty 01
Act I Patch analysis
chapter 01 / 18
2.8.6 on disk

A living plugin

Running in production. Tens of thousands of installs.

I Patch analysis
II Zero-day detection
III Verifier sort
commit · upstream
6802454 → mystickymenu 2.8.6 → 2.8.7
2 files · 1 security-sensitive hunk · 1 function touched
mystickymenu/classes/class-mystickymenu.php on disk · 2.8.6
1// classes/class-mystickymenu.php · 2.8.6
2public function save_lead($postArr) {
3 // 2.8.6: every POST key copied verbatim into SQL identifiers.
4 foreach ($postArr as $key => $val) {
5 $params[$key] = esc_sql(sanitize_text_field($val));
6 }
7 $params["widget_id"] = esc_sql(sanitize_text_field($widget_no));
8 $wpdb->insert($contact_lists_table, $params);
9 die();
10}
11
12// Reachable via admin-ajax.php · unauth · CWE-89.
CVE-2026-3657 high
CWECWE-89 · SQL injection (column identifier) CVSS8.6 · high vectorAV:N · AC:L · PR:N · UI:N KEVnot listed affectedMy Sticky Bar ≤ 2.8.6 fixed2.8.7
articles/cve-2026-3657.md ● writing · claude-haiku-4.5
install base
pluginmystickymenu version2.8.6 downloadsactive installs php>= 7.4
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
§01

Patch diff analysis

Reduce multi-thousand-line commits to the few hunks that actually move the security needle.

ANALYSIS open
§02

Zero-day detector

Pattern-match CWE signatures against uncommitted code before an advisory is ever written.

ZERO-DAY open
§03

Rule generator

Derive grep rules from verified vulnerabilities. Run them across your entire library.

RULES open
§04

PoC synthesis

AI drafts a reproducer from the patch. Reviewer verifies. Report shipped.

OUTPUT open
§ wordfence

Live WordPress feed

Pulls fresh advisories from the Wordfence API. Auto-PatchDiff scheduler diffs new plugin releases on a cron.

FEED view
§ tainttrace

InputTracer · PHP

Walks each variable backward through the AST until it confirms a user-controlled origin. Non-user-input candidates dropped before AI.

TAINT
§ defense

Wrapper unwrap · 3-iter

Identifies declared defense calls, follows wrapper chains to the native implementation, emits a verdict with structured evidence.

DEFENSE
§ wp-reach

Endpoint reachability

For WordPress plugins: verifies whether a vulnerable function is actually reachable from REST, AJAX, or admin pages. Auth-level surfaced.

WP
§02

How Products mode analyzes a patch

FOUR STAGES · DIFF-DRIVEN
stage 01

Reduce

The average security patch is buried under formatting, tests, vendored assets. We strip those noise hunks and keep what alters control flow, input handling, or crypto.

183 files  →  12 hunks  →  4 functions
stage 02

Match

Each remaining hunk runs against a CWE signature bank — taint analysis for injections, auth-check elisions, race windows, and crypto misuse.

CWE-89 · CWE-384 · CWE-352
stage 03

Reason

Claude Haiku reviews reduced hunks with CWE context and the project's own utility functions. It writes a one-paragraph verdict.

verdict true_positive · model claude-haiku-4.5
stage 04

Ship

A reviewer approves. PatchLeaks emits a CVE-ready writeup, a PoC request payload, detection rules, and a KEV flag — all from one pull request.

writeup · poc.sh · rules
§03

How Zero-Day mode finds vulnerabilities

SIX STAGES · PATTERN → TAINT → AI → REACT → DEFENSE → VERDICT
stage 01

Pattern match

CWE-specific grep + sink rules sweep the codebase. Thousands of files filtered to targeted matches.

CWE-89 · CWE-434 · CWE-79
stage 02

Taint trace

InputTracer (PHP) follows each variable backward through the AST to verify it originates in user input. Non-user-input matches discarded.

37 candidates kept
stage 03

Initial pass AI

Quick triage on grep-matched lines only. Drops obvious false positives before any deep scan.

37 → 5
stage 04

Deep scan AI

Full-file analysis with function-level tree-sitter context. Reasons about taint paths and missing safeguards.

5 → 2 confirmed
stage 05

Detection

Parses vulnerability blocks, verifies declared safeguards, deduplicates findings across files.

structured · per-block
stage 06

Defense check

3-iteration loop unwraps wrapper functions to native implementations. Final verdict carries structured evidence.

verdict · TP / FP / defended
§01

Live advisory feed

UPDATED EVERY 60s
CVE Severity Target Class Age —
Loading live feed…
12,578
CVEs indexed
89
patches parsed
204
PoCs generated
26
languages supported
--:--:--Z
last feed sync
§ready

Point it at a repo. Read the report.

Free, open-source, self-hosted.

Start a scan → Open dashboard