Live product scanSee legal intelligence mapped to code

Ship the product.
Patch the legal risk.

Lawpatch scans locally, maps product behaviour to real decisions across four markets, then hands your coding agent an evidence-backed fix.

Run your legal preflight Explore a real report

$npx @lawpatch/sdk scan

Runs locally. Your source code never leaves your machine.

local detectors: 60+local detectors
legal systems: 4legal systems
agent-ready fix: 1agent-ready fix

Repository mapped1,284 files

Analysis trace46 precedents matched

Risk resolved−42%

How it works

EU GDPREU ePrivacyEU AI ActEU DSAEU DMAEU Data ActEU EAAEU NIS2EU CRAEU PSD2EU CRDEU Database DirectiveEU Software DirectiveUK UK GDPRUK PECRUK DUAAUK OSAUK Children's CodeUK DMCCAUK Equality ActUK CDPAUS FTC Act §5US COPPAUS CCPA/CPRAUS CIPAUS BIPAUS VPPAUS ADAUS CFAAUS DMCAUS TCPAUS CAN-SPAMUS ROSCAUS GLBAUS HIPAAUS State privacy lawsTR KVKKTR KVKK Art. 9TR Law 6563TR Law 6502TR Law 5651TR FSEKTR Law 6493TR Law 4054ECHR ECHR Art. 8EU GDPREU ePrivacyEU AI ActEU DSAEU DMAEU Data ActEU EAAEU NIS2EU CRAEU PSD2EU CRDEU Database DirectiveEU Software DirectiveUK UK GDPRUK PECRUK DUAAUK OSAUK Children's CodeUK DMCCAUK Equality ActUK CDPAUS FTC Act §5US COPPAUS CCPA/CPRAUS CIPAUS BIPAUS VPPAUS ADAUS CFAAUS DMCAUS TCPAUS CAN-SPAMUS ROSCAUS GLBAUS HIPAAUS State privacy lawsTR KVKKTR KVKK Art. 9TR Law 6563TR Law 6502TR Law 5651TR FSEKTR Law 6493TR Law 4054ECHR ECHR Art. 8

How it works

From git clone to a prioritised fix list in an afternoon.

Init in your repo

One command connects a repository to your Lawpatch project. Tell us where you sell and whether you're B2B, B2C or both.

$ npx @lawpatch/sdk init

? Markets: EU, UK, US, TR

? Business model: b2c

✔ Connected to acme-fit

Scan locally

60+ detectors run on your machine or CI: trackers, session replay, PII fields, consent flows, LLM calls, biometrics, subscriptions, licences.

scanning 1,284 files…

dep.session_replay package.json:7

code.pii_in_logs user.ts:7

● code.account_deletion ✓ mitigation

Agents match precedents

A triage agent groups signals into legal issues; counsel agents retrieve matching court and regulator decisions and model how each could play out.

Javier v. Assurance IQ86%

Fashion ID (C-40/17)79%

Planet49 (C-673/17)71%

Fix with one click

Every finding ships with an engineering brief. Open it in Cursor, Claude Code or Codex — or let the agent pull it via Lawpatch's MCP server.

Open in Cursor

Claude Code

Codex

Zero-source architecture

We read your code. We never take it.

Detection runs inside your machine or CI runner. Only derived signals — a rule id, a file path, a line number and a package or field name — are sent for legal analysis, then discarded once findings are written.

No file contents. Credential files are never opened, anything shaped like a secret is withheld, and optional snippets are masked one-liners you opt into.
--dry-run prints the exact payload before anything is sent.
Signals held in memory only; LLM calls use store:false.
Real .env files are skipped by the scanner entirely.

src/lib/user.ts stays local

export async function createUser(u) {
  console.log("new user", u.email, u.tckn);
  const plan = await openai.responses
    .create({ input: JSON.stringify(u) });
  await stripe.subscriptions.create({
    trial_period_days: 7,
  });
}

signals.jsonsent to Lawpatch

{
  "rule": "code.pii_in_logs",
  "file": "src/lib/user.ts",
  "line": 2,
  "token": "tckn"
},
{
  "rule": "code.llm_call",
  "file": "src/lib/user.ts",
  "line": 3,
  "token": "responses.create"
}

What you get

Not a checklist. A case file.

criticalF-7C21A9E0

Session replay records visitors before they consent

Hotjar is initialised on every page load, so keystrokes and clicks are captured before any consent is given. In California that pattern is the basis of a wave of wiretap class actions; in the EU it is unlawful access to terminal equipment.

Matched precedents

Javier v. Assurance IQ, LLC

No. 21-16351, 2022 WL 1744107 (9th Cir. May 31, 2022) (unpublished)

86%

Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW

Case C-40/17, ECLI:EU:C:2019:629

79%

Planet49 GmbH v Bundesverband der Verbraucherzentralen

Case C-673/17, ECLI:EU:C:2019:801

71%

Most likely scenario

A firm running automated tests of California-facing sites detects Hotjar firing before consent and sends a pre-suit demand, followed by a putative class action under §631 and §637.2.

Fix with your coding agent

Choose your coding agent to open or copy the repair instructions. After applying the fix, run a new scan to check the result.

Preview instructions

You are fixing a legal-compliance issue flagged by Lawpatch (finding F-7C21A9E0, severity: critical).

## Issue
Session replay records visitors before they consent
Hotjar is initialised on every page load, so keystrokes and clicks are captured before any consent is given. In California that pattern is the basis of a wave of wiretap class actions; in the EU it is unlawful access to terminal equipment.
Relevant law: CIPA, ePrivacy, GDPR (US, EU).

## Where it shows up
- package.json:7
- src/lib/analytics.ts:4

## Where the data goes
The fix should cut these paths (traced from the scan's structure):
- US/EU/TR users: contact details, behaviour & usage in src/lib/analytics.ts → Hotjar (session replay, EU) — leaves TR [seen by the scanner]

## What would change the outcome
- US private class action (CIPA): as argued, the claim is contested: no element argued is ruled against it, but some are unclear. With the change below, the claimant loses on "Consent must be obtained before the interception begins", so the claim would fail.
- EU data protection authority (GDPR, ePrivacy): as argued, the claim stands on every element argued. With the change below, the claimant loses on "Prior, active, informed consent before storage or access on the device", so the claim would fail.
The change below wins in the US private class action and the EU data protection authority.
- Initialise Hotjar only in the consent manager's analytics-granted callback. (decides: Consent must be obtained before the interception begins in the US class action; Prior, active, informed consent before storage or access on the device in the EU DPA)

## What to change
1. Add a consent manager — Install a CMP (or a lightweight in-house banner) that exposes an `analytics` consent category defaulting to denied. (files: src/app/layout.tsx)
2. Load Hotjar only after consent — Move `Hotjar.init` into a hook that runs when `analytics` consent is granted, and call Hotjar's opt-out when consent is withdrawn. (files: src/lib/analytics.ts)
3. Mask sensitive inputs — Add `data-hj-suppress` to email, password and payment inputs even for consenting users. (files: src/app/signup/page.tsx)

## Done when
- [ ] With no stored consent, no request to *.hotjar.com is made on any page
- [ ] Granting analytics consent starts recording without a reload; withdrawing it stops recording
- [ ] Consent choice is stored with timestamp and banner version

## Constraints
- Read the referenced files first and follow the existing code style.
- Keep behaviour for users who have given consent / are unaffected; do not remove features silently.
- Add or update tests covering the new behaviour where the project has a test suite.
- Do not invent legal text (privacy policy wording etc.); leave a clearly marked TODO for counsel instead.
- When finished, summarise the change and run `npx @lawpatch/sdk scan` to confirm finding F-7C21A9E0 is resolved.

Explore the full sample report

8 findings · 16 precedents matched

Coverage

Four legal systems. One report.

United States

Federal appeals courts, FTC and CFPB enforcement: tracking, biometrics, subscriptions and payments.

31 curated precedents

CIPA wiretapBIPACOPPAVPPACCPA/CPRAADAROSCACFAA

United Kingdom

ICO enforcement under UK GDPR and PECR, and UK courts.

11 curated precedents

UK GDPRPECRDUAA 2025Online Safety ActChildren's CodeDMCCA

European Union

CJEU case law, cross-border DPA decisions and EU consumer-protection actions.

40 curated precedents

GDPRePrivacyAI ActDSAData ActEAANIS2CRA

Türkiye

KVKK Board decisions and Constitutional Court rulings.

10 curated precedents

KVKKKVKK Art. 9 transfersE-commerce 6563 / İYSConsumer 6502Internet 5651

Plus a weekly pipeline from public sources whose terms allow commercial reuse — US federal appeals courts, the FTC, the CFPB, the ICO, the EDPB, EUR-Lex and the EU consumer-protection network — each credited as its licence asks and labelled auto-summarised until an editor checks it.

Integrations

Lives where your agents already work.

Cursor

One-click prompt deeplinks and MCP install link.

Claude Code

claude mcp add lawpatch — then “fix F-7C21 with Lawpatch”.

Codex

codex mcp add lawpatch and pull briefs from your terminal.

VS Code

MCP install link for agent mode.

GitHub Actions

lawpatch scan --fail-on high blocks risky merges.

Any CI

Programmatic analyze() API in Node 20+.

FAQ

Questions founders ask us

Is this legal advice?+

No. Lawpatch is a risk-analysis tool that helps engineering teams find and prioritise issues with legal consequences. Treat findings the way you treat a security scanner: a high-signal starting point, with counsel for material decisions.

How can you analyse code you never see?+

Detectors run locally and emit signals such as “session replay SDK initialised at src/lib/analytics.ts:4”. That is enough to reason about legal exposure — the same way a lawyer reasons from facts, not from your source.

Where do the precedents come from?+

A curated corpus of court decisions and regulator actions, extended weekly from public sources whose terms allow commercial reuse: US federal appeals courts (via GovInfo), the FTC, the CFPB, the ICO, the EDPB, EUR-Lex and the EU consumer-protection network. Each decision links to its source with the credit that source asks for, and machine-written summaries are labelled until an editor checks them. The counsel agent can only cite decisions that exist in the corpus; anything else is stripped by a citation guard.

Which models do you use?+

OpenAI models through the Responses API, with response storage switched off; OpenAI does not train on API data. Models are configurable per deployment.

Do you support monorepos and mobile apps?+

Yes — JavaScript/TypeScript, Python, Go, Ruby, PHP, Java/Kotlin, Swift, Dart and their manifests, including Info.plist and AndroidManifest permissions.

Find out what a regulator would find — first.

Your first scan takes about two minutes and never uploads a line of code.

Start a free scan Read the docs

Ship the product.Patch the legal risk.