Vulnerability found, pull request opened: automatic fixing
Most tools stop where the work begins: they report a vulnerability and leave the rest to your team. Secupipe goes one step further. A finding comes with its fix, as a pull request in your repository, built and tested. If the update breaks something, an AI agent adapts the code.
From finding to pull request
- You click the fix button on the finding. Or you let Secupipe create jobs itself for all open findings from a chosen severity.
- A job in your pipeline picks up the jobs, for example once an hour.
- For each package it creates a branch, bumps the dependency to the fixed version and runs build and tests.
- If they are green, it opens the pull request (GitHub) or merge request (GitLab). Status and link appear in Secupipe on the finding.
Updated automatically: npm packages (direct and transitive), Go modules and pinned versions in requirements.txt. Other ecosystems are handled by the AI agent.
When the update breaks the build
A security update is often a jump across several versions, and then the library's interface changes. This is exactly where updates get stuck in practice. With the AI module an AI agent takes over: it reads the error, looks up what changed in the new version of the library and adapts your code until build and tests pass again. It is not allowed to disable tests or weaken checks.
An example from our test run
A small project uses the Markdown library marked in version 0.3.19, which has several known vulnerabilities. The update to 4.0.10 breaks the code: TypeError: marked is not a function, because the library has exported its function differently since version 4. The agent found the cause in about 15 seconds and changed one line:
- const marked = require('marked');
+ const { marked } = require('marked');
After that the tests passed again. The pull request contains a short summary from the agent: what it changed and why.
Three levels, you choose
| Mode | What happens |
|---|---|
| Version update only | Update, build and tests. On failure, a draft pull request with the log. No AI. |
| Update, AI on failure | As above. If the update breaks something, the AI agent adapts the code. |
| AI agent first | The agent reviews every job: where is the package used, is the vulnerability reachable at all? It adapts the code and summarises its review in the pull request. |
In the third mode the agent may also conclude that your project is not affected at all, because the vulnerable code is never called. It then opens no pull request, but proposes the assessment “not affected” with a justification in Secupipe. It takes effect only once a human approves it.
What the fix does not do
- It never merges. Every fix is a pull request. Your team reviews and decides.
- It does not leave your runner. Update, build, tests and AI agent run in your pipeline. Secupipe only receives the status, the link and the end of the log.
- It does not hide failures. If the build does not turn green, a draft pull request is created, with the error log.
How to set it up
Fix PRs are available from the Team plan, the AI levels with the AI module and your own key with the AI provider. On GitHub Actions:
jobs:
autofix:
runs-on: ubuntu-latest
container: ghcr.io/costa-chown/secupipe-autofix:1
steps:
- uses: actions/checkout@v5
- run: secupipe-autofix
env:
SECUPIPE_TOKEN: ${{ secrets.SECUPIPE_TOKEN }}
GITHUB_TOKEN: ${{ github.token }}
REPO: ${{ github.repository }}
AUTO: hoch
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
With AUTO: hoch (high) the job itself creates jobs for all open findings from “high” upwards. Without that line it only works through what you clicked in Secupipe. After the next SBOM upload the finding counts as fixed.
Vulnerabilities in your own code are found by the AI code scan; more in our post Your own code as the vulnerability.