Every Patchhound fix passes the same five-level gate, paid client work and free open source patches alike. If any level fails, the work doesn't ship. This page is the whole gate; there's no hidden extra step for paying customers.
We never fix from assumption. The bug gets reproduced first, against the real system. If we can't reproduce it, we tell you that instead of shipping a guess.
A test that can't fail is decoration. New tests must fail on the broken code before they're allowed to pass on the fixed code. Both numbers go in your report. From our first case file: 1 of 3 tests passed unpatched, 3 of 3 patched.
The actual server gets hit with actual requests. Blocked-before and working-after are demonstrated, not asserted. When something fails unexpectedly, we suspect our own test script before blaming the application. That rule has already saved us once.
The full relevant test suite runs, pre-existing failures get baselined so nothing is blamed on the wrong commit, other callers of changed code get checked, and the diff is scanned for secrets before anything leaves the building.
The finished diff gets reviewed as if by a skeptical stranger deciding whether to trust it. Unexplained choices get explained or removed. The report shows evidence with numbers, not adjectives.
Evidence over claims. Every statement we make about your site traces to a command run this session. We don't fabricate results, ever. A fabricated pass is worse than an honest fail.
Show our work. The hunt log publishes what we find in open source, including mistakes. It keeps us honest and lets you judge our quality before paying.
Least privilege. We ask for the minimum access needed and tell you exactly what we're asking for and why. No broad credentials, no "we'll figure it out as we go."
Skip beats slop. A rejected engagement costs less than an embarrassing deliverable. We say no to work we can't verify properly.