DEPENDENCY REMEDIATION

Vulnerabilities arrive. Fixes should too.

Detects vulnerable dependencies. Finds the minimum safe upgrade. Runs your tests. Opens a review-ready pull request.

See the npm example

Read-only GitHub access · Tests run before every PR · Code never used for model training

MAVEN DEMO TARGETPending verification

remedi-safe/remedi-demo

pom.xmlcommons-collections:3.2.1

A Remedi-generated Maven fix PR has not been verified in this repository yet.

View target repository

TRUSTED BY THE ECOSYSTEM

Works with the dependency ecosystem you already use.

HOW REMEDI WORKS

Security scanners find the problem. Remedi closes it.

01 / 04DETECT

Maven manifest target

The public demo repository includes the supplied dependency pin.

pom.xml · commons-collections:3.2.1

02 / 04RESOLVE

minimum-safe upgrade

A safe target version will appear with a verified remediation PR.

version update · pending

03 / 04VERIFY

Maven check pending

The repository check result has not been verified yet.

mvn -B verify · pending

04 / 04PR

fix PR pending verification

No Maven pull request is presented as proof until its repository and manifest diff are confirmed.

remedi-safe/remedi-demo

The npm example remains the only verified demo PR while Maven proof is pending.

WHY REMEDI

Don't send developers another alert. Send them the fix.

01 · MINIMUM-SAFE UPGRADES

Resolves the lowest non-vulnerable version.

Remedi finds the minimum safe version for an advisory and proposes a focused dependency change for review.

remedi-safe/remedi-demopom.xml · commons-collections:3.2.1safe target version · pending verification

02 · TESTED BEFORE YOUR TEAM SEES IT

Project checks run before review.

Maven verification for the new demo target has not been reported yet.

remedi-safe/remedi-demo $ mvn -B verify
Maven check · pending verification

03 · REVIEWABLE BY DESIGN

Drafts only. Your branch protection decides what ships.

Every Remedi PR is a draft. Existing CI, branch policies, and required reviewers are not bypassed — Remedi proposes, your stack approves.

polsia/remedi-demo-npm #1Verified npm example

Bump minimist from 1.2.5 to 1.2.6 (CVE-2021-44906 prototype pollution)

remedi/auto-fix-cve-2021-44906

CVE-2021-44906

View npm pull request example

LIVE PROOF

SECURITY MODEL

Designed to touch less.

Remedi proposes; your stack approves. Read-only GitHub scopes, ephemeral test runners, signed activity, and no auto-merge — every layer keeps you in control.

Read-only GitHub access

Read-only metadata + contents:write on the patch branch. No push to your default branch ever.

Ephemeral test environments

Each build runs in a throwaway sandbox. Source files are not retained, uploaded, or used to train any model.

Signed activity

Every webhook + scanner request is HMAC-signed with a per-installation secret. Replay attacks and forged advisories are rejected at the edge.

Human merge control

Draft PRs honor branch protection, required reviewers, and your existing CI. Nothing ships without your sign-off.

Read our security architecture

COMPARISON

Detection isn't remediation.

Six checks that decide whether an advisory PR actually ships.

Capability	Remedi	Dependabot	Traditional SCA
Detect known CVEs	Per push	Daily digest	Manual scan
Determine safe upgrade	Minimum-safe	Latest minor	Advisory only
Run tests before PR	Ephemeral sandbox	Lockfile only	Not run
Open review-ready PR	Draft + diff	Bump PR	Manual
Fast remediation workflow	< 60s median	Daily batch	Queued tickets
Human approval before merge	Required (draft)	Bypass policy	Manual gate

ECOSYSTEMS

Works across your dependency graph.

npmpackage.json

Live

PyPIrequirements.txt

Live

Go modulesgo.mod

Live

RubyGemsGemfile.lock

Live

CargoCargo.toml

Live

PHP Composercomposer.json

Live

Maven (Java)pom.xml

Coming soon

PRICING

Start with one repository.

Free for public and OSS repositories. Paid tier covers private repos, audit log, and SAML SSO.

Solo

For independents keeping a few private repos clean.

$99/ month

Billed per GitHub App installation. Cancel anytime.

Up to 3 private repos
Unlimited public repos
Auto-fix PRs for npm, Maven, and pip
Sandbox test-suite before any PR opens
OSV + GitHub Advisory DB across seven ecosystems

Secure checkout first. Private-repository scanning starts after payment and GitHub installation are verified.

Team

For teams that sign off PRs together — not solo.

$499/ month

Billed per GitHub App installation. Cancel anytime.

Up to 25 repos
Everything in Solo
SSO-ready posture (SAML SSO when connected)
Priority triage on critical advisories
Slack digest (coming soon)

Secure checkout first. Private-repository scanning starts after payment and GitHub installation are verified.

Open-source repositories are still free — auto-fix PRs forever, no card required.

Your vulnerability backlog should shrink itself.

Connect a repository. Remedi handles the next vulnerable dependency — and every one after that.

See the npm example