Detects vulnerable dependencies. Finds the minimum safe upgrade. Runs your tests. Opens a review-ready pull request.
Read-only GitHub access · Tests run before every PR · Code never used for model training
@@ package.json @@
- "next": "14.2.5"
+ "next": "14.2.18"
@@ package-lock.json @@
- "version": "14.2.5"
+ "version": "14.2.18"CVE published
OSV + GitHub Advisory DB match the dependency graph on next push.
next 14.2.5 → OSV matchminimum-safe upgrade
Resolves the lowest non-vulnerable version satisfying the advisory.
next 14.2.5 → 14.2.18test suite passes
Ephemeral sandbox runs the repo's full test surface.
184 / 184 passedreview-ready fix
Opens a single-package PR with the full unified diff inline.
polsia/remedi-demo#14PR opened 42 seconds after the advisory was published.
Remedi doesn't move you to latest — it moves you to the version that closes the advisory without crossing a breaking change. The PR diff stays a single line.
Every patch runs in an isolated sandbox against the project's own test command. Builds that fail never reach a branch.
~/remedi-demo $ npm test
PASS tests/auth/redirect.test.ts
PASS tests/middleware/csp.test.ts
PASS tests/render/edge.test.ts
…
Tests: 184 passed, 184 total
Time: 12.4sEvery Remedi PR is a draft. Existing CI, branch policies, and required reviewers are not bypassed — Remedi proposes, your stack approves.
Bump minimist from 1.2.5 to 1.2.6 (CVE-2021-44906 prototype pollution)
remedi/auto-fix-cve-2021-44906
CVE-2021-44906Remedi proposes; your stack approves. Read-only GitHub scopes, ephemeral test runners, signed activity, and no auto-merge — every layer keeps you in control.
Read-only metadata + contents:write on the patch branch. No push to your default branch ever.
Each build runs in a throwaway sandbox. Source files are not retained, uploaded, or used to train any model.
Every webhook + scanner request is HMAC-signed with a per-installation secret. Replay attacks and forged advisories are rejected at the edge.
Draft PRs honor branch protection, required reviewers, and your existing CI. Nothing ships without your sign-off.
Six checks that decide whether an advisory PR actually ships.
| Capability | Remedi | Dependabot | Traditional SCA |
|---|---|---|---|
| Detect known CVEs | Per push | Daily digest | Manual scan |
| Determine safe upgrade | Minimum-safe | Latest minor | Advisory only |
| Run tests before PR | Ephemeral sandbox | Lockfile only | Not run |
| Open review-ready PR | Draft + diff | Bump PR | Manual |
| Fast remediation workflow | < 60s median | Daily batch | Queued tickets |
| Human approval before merge | Required (draft) | Bypass policy | Manual gate |
Free for public and OSS repositories. Paid tier covers private repos, audit log, and SAML SSO.
Billed per GitHub App installation. Cancel anytime.
Payment link provisioned once Stripe is connected — install on a single repo first, then upgrade from the dashboard.
Billed per GitHub App installation. Cancel anytime.
Payment link provisioned once Stripe is connected — install on a single repo first, then upgrade from the dashboard.
Open-source repositories are still free — auto-fix PRs forever, no card required.
Connect a repository. Remedi handles the next vulnerable dependency — and every one after that.