A narrow, reviewable fix.
Semgrep checks supported JavaScript, TypeScript and Python patterns. Automatic fixes cover allowlisted MD5/SHA-1 calls. Other code findings stay manual.
Software Assurance
Your code hasvulnerabilities.Neolyt fixes them.
Scan your GitHub repositories, fix supported security issues, and review the evidence before merging.
Illustrative fix workflow
example/integrity-serviceIllustrative demo / synthetic repository
MediumSemgrep / 1 targeted finding
Weak cryptographic hash
src/integrity.ts:4A SHA-1 call in an integrity helper matches a supported weak-hash rule.
Initial scan: Semgrep, Gitleaks and Trivy. Other findings are outside this example.
Targeted fix / one file
Propose SHA-256.
- crypto.createHash("sha1")+ crypto.createHash("sha256")Changing the hash can change stored digests and integrations. Syntax and scanner checks do not establish functional compatibility.
Proposed commit / required checks
Checks complete.
- Patch policy and TypeScript syntax checks pass.
- Semgrep and Gitleaks complete; original finding no longer detected.
- No new Critical or High finding within those checks.
Trivy is not part of this verification. No application tests are executed.
Pull request / open, unmerged
Verified Fixed
neolyt/fix-weak-hashThe published tree matches the validated patch. Your review comes next: check compatibility and run your CI before deciding to merge.
Illustrative proposed commit
7c8e912f4a6d0b351e29c87a6d4f018b23ce590aOne finding. One verified fix. One pull request.
Proposed commit only. Not merged or deployed. Human review and project CI are still required.
Example summary: one SHA-1 finding, a targeted SHA-256 patch, policy and syntax checks, then Semgrep and Gitleaks on the proposed commit. An open PR is ready for review, not merged.
From finding to review
The fix. The evidence. In one place.
Neolyt connects security findings to reviewable changes. For supported weak-hash patterns, it proposes a targeted fix, checks the result and opens a pull request.
For everything else, your team gets the location, evidence and remediation context to decide what to do next.
Explore the product and its limits →Detection is not automatic remediation
Know what can be fixed.
Know what needs you.
Rotate. Then re-scan.
Detected credentials require revocation and rotation. Removing a key from source does not invalidate it, so Neolyt does not label that an automatic fix.
Upgrade with context.
Trivy identifies supported dependency and configuration issues. Your team chooses the change, checks compatibility and runs project tests.
Understand
Signals become decisions.
A finding points to a decision, not just a severity. Here is the reasoning behind the same illustrative fix.
MediumWeak cryptographic hash
Evidence / illustrative
src/integrity.ts:4Semgrep reports a SHA-1 call in the integrity helper.
DecisionReview a targeted SHA-256 proposal.
Check consumers of the digest before merging. Password storage needs a dedicated password-hashing algorithm, not this substitution.
Optional AI explanations help interpret existing evidence. They are not the proof that a fix works.
Verified Fixed
A specific fix.
A specific commit.
Evidence you can review.
The original finding is no longer detected, required scanners complete, and no new Critical or High finding appears within those checks. The published patch matches the validated files.
In this example, verification runs Semgrep and Gitleaks, not Trivy. It covers the proposed commit, not your main branch or deployed application.
Understand the verification boundary →Human control
Neolyt proposes.
You decide what ships.
Neolyt opens a separate branch and an unmerged pull request. It does not run your application tests, merge the change or deploy it.
Illustrative PR / open, unmergedneolyt/fix-weak-hash
Review the diff. Check compatibility. Run your CI.
Access and trust
Your repository is not a blank cheque.
The workflow and worker image have been validated locally. Hosted customer execution still requires pilot qualification; connecting customer repositories is not open self-service.
01
You select the GitHub repositories in scope.
02
The remote worker receives read-only, short-lived access.
03
Repository builds, tests and application code are not executed.
04
The Control Plane publishes a separate branch, never an automatic merge.
Start with a conversation
See the workflow.
Discuss your use case.
A demo shows the supported workflow. A pilot request starts a discussion about fit, scope and conditions; it does not activate repository access.
contact@neolyt.fr