One finding. One verified fix. One pull request.
A synthetic TypeScript example, not a live scan or a customer repository. Inspect each step, including the proposed commit and the unmerged PR.
Illustrative fix workflow
Weak cryptographic hash
src/integrity.ts:4A SHA-1 call in an integrity helper matches a supported weak-hash rule.
Initial scan: Semgrep, Gitleaks and Trivy. Other findings are outside this example.
Propose SHA-256.
- crypto.createHash("sha1")+ crypto.createHash("sha256")Changing the hash can change stored digests and integrations. Syntax and scanner checks do not establish functional compatibility.
Checks complete.
- Patch policy and TypeScript syntax checks pass.
- Semgrep and Gitleaks complete; original finding no longer detected.
- No new Critical or High finding within those checks.
Trivy is not part of this verification. No application tests are executed.
Verified Fixed
neolyt/fix-weak-hashThe published tree matches the validated patch. Your review comes next: check compatibility and run your CI before deciding to merge.
Illustrative proposed commit
7c8e912f4a6d0b351e29c87a6d4f018b23ce590aProposed commit only. Not merged or deployed. Human review and project CI are still required.
Example summary: one SHA-1 finding, a targeted SHA-256 patch, policy and syntax checks, then Semgrep and Gitleaks on the proposed commit. An open PR is ready for review, not merged.
Detection is broader than automatic fixing.
Current capability scope. An explanation or detection does not mean an automatic fix is available.
| Surface | Detection | Explanation | Automatic fix | Human intervention |
|---|---|---|---|---|
| Secrets | Gitleaks patterns; Trivy secret checks in the configured scan. | Redacted evidence and remediation guidance; optional AI explanation. | Not supported. | Revoke and rotate the credential, remove exposure, then re-scan. Source removal alone is not enough. |
| Dependencies & configuration | Trivy checks supported manifests, lockfiles and configuration against its available database. | Package, advisory or rule context; optional AI explanation. | Not supported. | Choose an upgrade or configuration change, assess compatibility and run project tests. |
| Source code | Neolyt Semgrep rules for JavaScript, TypeScript and Python. | Location, rule, evidence and remediation guidance; optional AI explanation. | Allowlisted weak-hash patterns only: supported MD5/SHA-1 calls to SHA-256. | Review every patch and run CI. Ambiguous, architectural and other code findings require manual remediation. |
Start with selected GitHub repositories.
The GitHub App integration supports selected repositories, including private repositories. The workflow has been exercised on a dedicated private QA repository. Customer repository access still requires pilot approval.
- Semgrep code rules currently cover JavaScript, TypeScript and Python, not every language or vulnerability class.
- Gitleaks and Trivy coverage depends on supported content, available databases and enabled scanner policy. The scan does not inspect Git history or run the application.
A supported fix is deliberately specific.
The deterministic generator can replace supported MD5/SHA-1 calls with SHA-256 for allowlisted weak-hash findings. It rejects ambiguous or unsafe transformations. A match is not permission to change the meaning of your application.
- Secrets require revocation and rotation. Dependency upgrades require compatibility decisions.
- Architectural findings, unsupported rules and ambiguous locations require manual remediation.
- Optional AI explanations interpret bounded finding context; the AI explanation is not the fix generator or verification gate.
Read the scope of the proof.
The example starts with Semgrep, Gitleaks and Trivy. Fix verification re-runs Semgrep and Gitleaks on the proposed change, checks the original finding and looks for new Critical or High findings in that scope. It does not establish that Trivy findings have disappeared.
- Patch policy prevents scanner suppression. TypeScript syntax is checked without executing repository code.
- The exact published commit must match the validated files; the PR remains open and unmerged.
- Application tests, behavior, deployed state and vulnerabilities beyond the executed checks are not covered.
The proposal arrives in GitHub.
After the required checks, the Control Plane publishes a dedicated branch and pull request. It does not push to the source branch or merge the PR. Your team reviews the diff, runs its normal CI and decides whether to merge.
Discuss a demo or pilot →