Question 1

What GitHub permissions does Remedi request?

Accepted Answer

When you install Remedi, you choose whether it can access one repository, selected repositories, or all repositories. Remedi requests three GitHub App permissions: Contents: Read & write, to read dependency manifests and lockfiles and push a proposed fix to a patch branch; Pull requests: Read & write, to open pull requests for fixes; and Metadata: Read-only, to identify repositories and read basic repository metadata. Remedi does not write to your default branch.

Question 2

Are public and private repositories both supported?

Accepted Answer

Public-only installations are free. If an installation contains any private repository, it needs an active Solo or Team subscription before Remedi can scan that installation. The subscription gate applies to the whole installation, including mixed public-and-private installations; private repositories are not scanned until the subscription is active.

Question 3

What repository data does Remedi read?

Accepted Answer

When Remedi scans a repository, it reads the dependency manifest and lockfile files required by that ecosystem from GitHub and runs the relevant audit tool against advisory data. It stores normalized findings and the audit tool’s report with each scan. To generate an npm fix, Remedi sends the repository’s package.json and advisory details to Polsia’s AI proxy; the proposed diff is restricted to package.json and package-lock.json.

Question 4

How does Remedi deliver automated dependency fixes?

Accepted Answer

Remedi delivers automated dependency fixes as GitHub pull requests containing the proposed dependency changes, rather than directly changing repository code.

Question 5

What if a finding is a false positive?

Accepted Answer

Remedi reports dependency versions that its ecosystem audit tools match to published advisories; it does not inspect your application code to determine whether it reaches the vulnerable function, so a finding may not affect your use. Review the advisory and proposed change. If Remedi opened a pull request, you can close it or leave it unmerged; there is no in-product control to dismiss an individual finding today.

Question 6

How can I review and control changes Remedi proposes?

Accepted Answer

Remedi opens a pull request containing the proposed dependency change for your review. You can inspect the diff and checks, apply your existing branch protection and required-reviewer rules, and use your normal GitHub process to merge, close, or leave it unmerged. Remedi does not auto-merge or merge on your behalf.

Question 7

Which ecosystems does Remedi detect and auto-fix?

Accepted Answer

Remedi currently supports npm, PyPI, Go modules, RubyGems, Cargo, and Composer. npm is live. Maven is marked coming soon: its adapter is implemented, but public proof is still pending, so Maven is not yet generally available.

Question 8

How much does Remedi cost?

Accepted Answer

Solo is $99/mo and Team is $499/mo. Public-only installations are free. An installation containing a private repository needs an active Solo or Team subscription for scans across that installation. See the pricing page for current paid plan scope.

Question 9

Why are Solo and Team paid?

Accepted Answer

Solo is $99/month for up to 3 private repos, while Team is $499/month for up to 25 private repos. Team is for teams signing off pull requests together and includes an SSO-ready posture and priority triage. Paid private-repository access enables Remedi’s dependency scanning and reviewed pull request workflow on private or mixed installations that cannot use the public-only free path. Public-only installations remain free, and an active subscription gate applies before private scans run.

Question 10

What is the planned fallback rate for metered billing?

Accepted Answer

The planned fallback rate is $0.50 per verified merged PR. Metered billing is not active until the required price configuration is available and the tier is enabled. Customers are not currently being charged this rate.

Frequently asked questions

Ready to get started?