This page states plainly what the product does not cover, not as fine print, but as the same-weight counterpart to the claims on the front page. Numbers here are quoted from/facts, not restated by hand.
Patchward runs Semgrep, Bandit, pip-audit, Trivy, ESLint. It does not run every possible static analyzer, and a finding class outside these five's coverage will not be caught.
Runs against your real test suite in the normal (CLI-delivered) case. On the hosted webhook path, when no test runner is present, Gate 3 skips and the PR discloses this explicitly rather than proceeding silently or failing the whole fix.
The triage and fix-generation stages send repository file contents to the Anthropic API to do their work. Credential scrubbing applies to Patchward's own CLI output and logs — not to what is sent to Anthropic.
CLI, run by Yehor directly against the customer's own repository. This is a present-tense fact about how the product is used today, not a permanent architectural claim — it will be revisited as the hosted path takes on real installations.
Patchward opens a draft PR. It does not merge to your main branch under any circumstance. Your team reviews and merges every change.