The current allowlist
Automatic remediation covers specific Semgrep weak-hash rules for JavaScript/TypeScript and Python. Supported MD5/SHA-1 calls can be replaced with SHA-256 using a deterministic transformation. The finding must have an eligible status, an allowed source path and unambiguous evidence.
Understand the proposed change
Review the affected file and diff before merging. Changing a hash can change digest lengths, stored values and protocols consumed by other systems. This is not a general password-storage migration: passwords need a dedicated password-hashing algorithm.
- Ambiguous matches, unsupported syntax or broad changes are rejected or remain manual.
- Scanner suppression, ignore-file changes and unsafe paths are rejected.
- Repository tests, builds and package managers are not executed by the worker.
Use the right manual response
A manual finding is not a failed promise of automatic repair. Some remediation requires decisions outside a safe source transformation.
- Secrets: revoke or rotate the credential, remove exposure, inspect consequences and re-scan. Deleting source text does not revoke a key.
- Dependencies: choose an appropriate version and run compatibility tests.
- Architectural and other code findings: investigate the cause, implement the change and verify with project-specific checks.
Inspect the PR and run CI
A successful attempt produces a separate branch and an unmerged PR tied to the verified change. Your team still checks behavior and runs its usual CI. Neolyt does not merge, deploy or certify the application.
Read the verification contract →