GitHub App · reads OSV + GitHub Advisory DB on every push

Autonomous vulnerability patching from detection to PR in seconds.

Fewer CVEs staying open. Zero human toil chasing dependency upgrades — the auto-fix pull request lands itself, with a tested diff you actually review.

See a real PR
Read-only scoped permissionsTest-suite validation in an ephemeral sandboxPrivate-repo native

Latest auto-fix PR

maven
open · 2 minutes after CVE published

polsia/remedi-demo #14

Bump next from 14.2.5 to 14.2.18 (CVE-2025-29927 middleware bypass)

remedi/auto-fix/next-14.2.18

CVE-2025-29927
npm#1
Live proof
Live proof

From advisory to merged PR — without a human in the loop.

maven

This pull request was opened autonomously by Remedi 2 minutes after CVE published — a signed, reviewable, single-package upgrade with the relevant CVE referenced and the full unified diff attached.

polsia/remedi-demo #14

Bump next from 14.2.5 to 14.2.18 (CVE-2025-29927 middleware bypass)

CVE-2025-29927
remedi/auto-fix/next-14.2.182 minutes after CVE published
unified diff±2 lines
@@ package.json
- "next": "14.2.5"
+ "next": "14.2.18"
@@ package-lock.json
- "version": "14.2.5"
+ "version": "14.2.18"
View PR #14
npm

This pull request was opened autonomously by Remedi 2 minutes after CVE published — a signed, reviewable, single-package upgrade with the relevant CVE referenced and the full unified diff attached.

polsia/remedi-demo-npm #1

Bump minimist from 1.2.5 to 1.2.6 (CVE-2021-44906 prototype pollution)

CVE-2021-44906
remedi/auto-fix-cve-2021-449062 minutes after CVE published
unified diff±2 lines
@@ package.json
- "minimist": "1.2.5"
+ "minimist": "1.2.6"
@@ package-lock.json
- "version": "1.2.5"
+ "version": "1.2.6"
View npm PR #1
Supported ecosystems

Works with your stack.

Five ecosystems shipping today, more on the roadmap. Each one reads the lockfile you already commit, runs your tests in a sandbox, and opens a signed pull request.

npmnpm

npm

GitHub Advisory Database

Detects vulnerable lodash in package-lock.json and opens a signed PR bumping to the patched minor.

PyPI

PyPI

pip-audit

Flags an unsafe requests pin in requirements.txt and proposes the cleared minimum version with a passing test run.

Go modules{ go }

Go modules

govulncheck

Spots an unreachable stdlib call in go.mod and opens a PR to a patched minor with the build still green.

RubyGems

RubyGems

bundler-audit

Catches a transitive nokogiri CVE in Gemfile.lock and bumps to the maintained release behind a passing bundle install.

Cargo

Cargo

RustSec Advisory Database

Catches a vulnerable chrono CVE pinned in Cargo.lock and bumps it to the cleared minimum via cargo audit in CI.

Same PR quality across every ecosystem — CVE table, GHSA permalinks, signed commits, tests-run block.

How it works

Three steps. Zero human toil.

The full path from a fresh advisory to a mergeable pull request, end to end.

  1. 01

    install

    Install the App

    One click from the GitHub marketplace. Read-only permissions, scoped to the repositories you choose. No secrets to mint, no agents to host.

  2. 02

    watch

    Watch your dependency graph

    Remedi reads your lockfiles on every push and cross-references them against the OSV database and the GitHub Advisory Database — npm, pip, gem, cargo, and 12 more ecosystems in one pass.

  3. 03

    open

    Open PRs with tested fixes

    We resolve the minimum-safe upgrade, run your test suite in an ephemeral sandbox, and open a reviewable pull request with the CVE referenced and the full unified diff attached.

In flight

From advisory to merged PR — in under sixty seconds.

A four-stage loop driving the path from a published CVE to a green CI run, played from the exact same data your dashboard surfaces after install.

remedi · run #14 (maven)CVE-2025-29927
01 · CVE detected scan
$ remedi scan polsia/remedi-demo
! CVE-2025-29927 vulnerable
→ advisory: CVE-2025-29927
02 · fix computed resolve
$ remedi resolve
min-safe upgrade: next@14.2.18
sandbox tests: 3/3 passed
03 · PR opened open
$ remedi pr
+ "next" → "14.2.18"
→ View PR #14
04 · CI green merge
$ remedi status
✓ CI checks passed
✓ ready for review
liveDemo cycle:01 · CVE detected02 · fix computed03 · PR opened04 · CI greenView PR #14npm#1

Built from the same data as the live PR card — View PR #14.

Ecosystem coverage

Every dependency graph we can patch today.

Seven ecosystems backed by shipped adapters — manifest, advisory database, and shipping status per row.

npm
package.json
GitHub Advisory Database
Live
PyPI
requirements.txt
PyPI Advisory Database
Live
Go modules
go.mod
Go Vulnerability Database
Live
RubyGems
Gemfile.lock
RubySec Advisory Database
Live
Cargo
Cargo.toml
RustSec Advisory Database
Live
PHP Composer
composer.json
FriendsOfPHP security-advisories
Live
Maven (Java)
pom.xml
OWASP Dependency-Check + OSV
Beta
Why Remedi

Remedi vs Dependabot vs Snyk.

The four capabilities that decide whether an advisory PR actually gets reviewed and merged — not just opened.

CapabilityRemediDependabotSnyk
Full test-suite validation before PREphemeral sandbox runnerLint + lockfile onlyManual
Sub-minute time-to-PR< 60s on median advisoryDaily digestManual triage
Private-repo nativeYes (GitHub App)Yes (GitHub App)Yes (paid plan)
Transparent unified diffsEvery change, inlineBumps onlyPR with advisory link
Security & trust

Built for production codebases. Audited by construction.

Every layer of Remedi — installer, runner, and outbound requests — is designed to be the most boring, least-trusted layer of your stack.

  • Read-only scoped GitHub App

    The installer requests read-only metadata, contents, and pull-request scopes. Remedi cannot push to your default branch — every change is opened as a pull request you review and merge.

  • No code leaves the ephemeral sandbox

    Each build runs in a throwaway sandbox. Your source files are not retained, not uploaded, and not used to train any model — they only ever pass through the ephemeral runner.

  • Webhook + scanner requests are signed

    Every GitHub webhook and outbound scanner request is HMAC-signed with a per-installation secret. Replay attacks and forged advisories are rejected at the edge.

  • SOC 2 Type II readiness in progress

    Independent attestation workstream is active. Audit log, access controls, and customer data isolation are documented and tracked to completion.

Runs on your repos, sends no code off-platform

Every change is computed inside the GitHub App installer. Source files never leave your repository — they only ever pass through the ephemeral runner.

Fixes tested against your CI

Before a patch is opened as a PR, your test suite runs in a throwaway sandbox. Builds that fail never land on a branch.

Audit log on every action

Scan trigger, patch selection, sandbox result, PR URL — every step is signed and recorded so you can trace who, what, and when.

Pricing

Free for the public web. Paid where the audit trail matters.

Public repositories and OSS get auto-fix PRs forever, at no cost. Private repositories move to a paid tier with the controls a security team needs to sign off.

Solo
Paid tier
Solo
For independents keeping a few private repos clean.
$19/ month

Billed per GitHub App installation. Cancel anytime.

  • Up to 3 private repos
  • Unlimited public repos
  • Auto-fix PRs for npm, Maven, and pip
  • Sandbox test-suite before any PR opens
  • OSV + GitHub Advisory DB across seven ecosystems

Stripe Payment Link still being provisioned — check back shortly.

Team
Most popular
Team
For teams that sign off PRs together — not solo.
$99/ month

Billed per GitHub App installation. Cancel anytime.

  • Up to 25 repos
  • Everything in Solo
  • SSO-ready posture (SAML SSO when connected)
  • Priority triage on critical advisories
  • Slack digest (coming soon)
    Coming soon

Stripe Payment Link still being provisioned — check back shortly.

Open-source repositories are still free — auto-fix PRs forever, no card required.

Not ready yet? Get notified when we ship GitHub App one-click install.

Today's install loops through a GitHub marketplace confirmation. A one-click install means you press install in Remedi and we open the PR pipeline against your repo — no marketplace round-trip.

We'll send a confirmation and reach out when GitHub App one-click install is live.

Audit log you can hand to security
Every scan, patch selection, sandbox result, and PR URL — signed, timestamped, and exportable. Frameworks stop asking for screenshots.
Custom policies, repo by repo
Critical-only on your money path. Auto-merge on internal tooling. Hold for review on auth code. Per-repo rules without per-repo babysitting.
SAML SSO + dedicated installation
Identity lives in your IdP, secrets live per-installation, and audit reads stay attached to the team that owns the repo.

Install on any repo — public or private.

The same GitHub App covers both tiers. Private-repo features unlock once your team is on the paid plan.

Talk to us about pricing
Get started

Ready when you are. Five minutes to install.

Ready in under five minutes — install from the GitHub marketplace and we'll open your first auto-fix PR the moment a published advisory matches your dependency graph.

Typical time-to-first-PR: under 72 hours after install
See pricing