Vulnerability Autofix

Goal and eligibility

Vulnerability Autofix turns a current security-audit candidate into one durable provider issue and, when permitted and safe, one linked pull or merge request. It requires a valid repository target and the project-scoped candidate context produced by the security audit. That context fixes audit-time scope and ordering, but it is neither current truth nor write permission.

Current-state checks

Before writing, Guard validates repository identity, checks the current default-branch commit, searches open and recent issues and review requests, and replays candidates in audit order. Each candidate is classified as still applicable, already fixed, covered by existing work, stale, too risky, ambiguous, or safe to fix. If none of the queued candidates is safe, a bounded fallback may search only inside the audit-defined paths, components, and weakness classes.

Issue-first behavior

Issue-only mode creates or reuses one issue and never edits files. Issue-plus-review-request mode also begins with the issue. It can proceed to code only when the selected candidate is useful, current, duplicate-free, small, reversible, reviewable, and credibly verifiable.

Broad authentication redesign, public API breaks, database migrations, cross-service contracts, major dependency upgrades, rollout-sensitive infrastructure, and product decisions remain issue or needs-human-review outcomes.

Proposal and verification

The patch stays focused on the selected vulnerability and follows repository guidance. Guard records the source evidence, exact change, verification commands and results, risks, and limitations. If verification fails or cannot become credible, it does not push or open an autonomous review request. A useful issue can still carry the remediation direction.

Guard never pushes to the default branch and never merges.

Outcomes and rerun

Possible outcomes include issue created or reused, issue plus PR/MR, already resolved, covered by existing work, needs human review, no actionable fix, invalid source context, or report only. After a human merges a fix, rerun the Security audit against the resulting commit. The new audit evidence closes the loop.