Code Remediation
Confirmed findings come back as verified patches: each re-tested against the scanner that raised the original finding, delivered as reviewable changes your developers approve and merge.
From confirmed finding to verified patch. Click a finding in Keygraph. An agent reads the evidence, authors a candidate fix, and re-runs whatever proved the issue (the scanner, or the working exploit) to confirm the vulnerability no longer reproduces. The verified patch lands in your normal review workflow; nothing merges without developer approval.
Works across your scanners and your stack.
Code Remediation covers the finding classes where a patch can be generated and re-verified against the originating scanner. It delivers to the source control your team already uses.
Point issues, data-flow vulnerabilities, and confirmed business-logic findings.
Confirmed exploits from the agentic pentester come back as patches with the exploit record attached as evidence.
SCA and Secrets remediation are on the roadmap.
Source control coveragePatches land in your existing GitHub Cloud or Enterprise Cloud workflow. Self-hosted GHES support is on the roadmap.
All GitLab hosting modes are supported, including GitLab Self-Managed (CE and EE) at modern versions. Patches arrive as merge requests in your GitLab project.
Verified before it ships.
Before a patch is ever delivered to your developers, it has to prove it closed the original vulnerability. If it doesn't, no patch. No noise in your queue.
Keygraph re-runs the same scanner that produced the finding against the patched code, scoped to the affected files. The vulnerability has to actually disappear.
If the first attempt doesn't land, the agent gets a bounded number of retries with the verifier's feedback. If it still can't fix it cleanly, no patch is delivered and the failure is surfaced for a human.
Every patch ships with the proof: scanner output before, scanner output after, and the diff that closed the gap. That bundle is a permanent, shareable record of how the risk was closed. When a patch attempt fails verification, you get a structured failure reason instead of a silent skip.
The review gate stays yours.
Patching removes authoring cost, not the approval step. No patch is ever applied without your developers' explicit review, and no merged patch is ever auto-reverted. The merge decision stays with your team.
Every patch is attributed to a clearly labeled Keygraph bot. Easy to spot in your history, easy to audit.
No second review surface. Patches arrive as reviewable pull requests (merge requests on GitLab) in your existing GitHub or GitLab workflow, alongside every other change.
Patching never spawns automatically. Someone clicks the finding in Keygraph. That's the trigger.
A patch is delivered only when every instance of the vulnerability within the patch's scope is fixed and verified. All-or-nothing.
Stop shipping the vulnerability. Ship the fix.
Schedule a demo and watch Code Remediation turn a real vulnerability in your codebase into a verified patch.