security-fix

Automated vulnerability patching runs parallel code-reviewer and security-reviewer processes to filter CRITICAL and HIGH findings, apply minimal fixes, and verify builds. This pipeline scopes entire repositories or targeted directories to remediate issues before committing changes.

Fixing high severity findings requires applying strict minimum-diff changes to the affected code. The workflow enforces evidence-based validation and mandatory user confirmation before executing automated patches, ensuring fixes do not introduce regression or break existing functionality.

End-to-end security fix workflows support scoping targeted directories as well as entire repositories. You can invoke the review and fix pipeline across a specified path to isolate critical vulnerabilities and apply patches without scanning unrelated code.

Automated security verification follows a structured phase-driven workflow that validates patched code using evidence-based testing. After applying fixes, the pipeline executes verification checks to confirm a clean build and test suite before proceeding to the final commit phase.

Manual confirmation is mandatory before the pipeline proceeds to the fix execution phase. The workflow pauses for user approval after evaluating CRITICAL and HIGH findings, ensuring you maintain control over automated patching and subsequent commits.

Automated security review for regulatory audits focuses strictly on CRITICAL and HIGH severity findings. It filters out lower severity issues and requires mandatory user confirmation at Phase 3, meaning it does not provide a comprehensive low-severity compliance checklist without manual supplemental review.