Patch the Planet

“We had a security audit last year, and have had countless people running AI audits on our codebase and reporting every nit-pick they could find. Despite this, Patch The Planet with GPT-5-cyber found 9 new vulnerabilities in just 4 days, plus several other concerns. The reports were higher quality (correct reproducer, clear explanation, accurate impact...) than every single other report we've received this year.”

“I really appreciated how Patch the Planet started with a scoping conversation so we could give context on past security reviews and what parts of the codebase have not received as much attention. The combination of Trail of Bits folks driving the engagement, the capabilities of frontier models, and that Trail of Bits triaged the results and worked with us to produce patches meant that important fixes got to our users very quickly.”

“The engineers we worked with were highly competent and really passionate about the work. We had real security bugs being found in the first day. The precision and accuracy is incredible. We now have hundreds of actionable bug reports, many with proposed fixes, and we've dramatically improved our understanding of what it will take to secure our project long term.”

“It was very good working with Filipe, and the quality of the feedback was excellent. The depth of analysis was excellent, along with the test suite additions. I'd have liked to have started on it earlier!”

“Excellent engineer and lots of great findings. It will take us a while to get through them all. The findings were accurate and in depth, and having the POCs was excellent for verification.”

“It was light-years ahead of the typical AI slop reports, it actually produced useful results/findings, not just in the sense of ‘this needs to be fixed’ but also surfaced design decisions made 10, 20, 30 years ago that are baked into the code and should be documented somewhere.”

“It was quite a joy to be able to hand off triage and patch prep to an experienced cryptography reviewer. PtP found several legitimate security bugs in quite obscure corners. Some of these bugs were quite long lived, and had already been missed by multiple security audits and an extensive LLM bug finding campaign.”

“The findings were all correct, realistically assessed for threat level, and came with working patches that only needed minor tweaks on our side. Other AI-generated reports we receive are typically right about there being a bug, but almost always wrong about the security model of our project.”

“The Trail of Bits team made time to understand our project, including where and how to focus the code analysis. Their reports nail our desired level of detail: all the essential information, clearly structured and reproducible, without the excessive verbiage, noise, and overconfidence that LLM-based reports often have.”