Remediation

Remediation is the part of Automations that fixes findings rather than only reporting them. A Hacktron agent analyses the vulnerability, writes a fix, and opens a pull or merge request with the change. You review and merge it like any other pull request.

Remediation runs use automation credits. You can start a run yourself from a finding, or let an automation’s Remediation action start it.

How a run tests the patch

A remediation run works the way an engineer would:

1. It checks that the finding is real, by testing whether the reported issue is exploitable in this code. If the finding is wrong, for example because the code is unreachable, Hacktron reports it as a false positive. Hacktron never tries to fix code that is already sound.

2. It makes the minimal correct fix that addresses the root cause of the vulnerability.

3. It tests the fix. It runs the repository’s existing test suite, if there is one, and adds relevant regression tests, to make sure the fix addresses the issue without breaking anything else.

Remediate a finding

Open a finding

Open the finding in the Hacktron dashboard, in the finding detail panel or on the full finding page.

Select Remediate

Open More actions in the toolbar and select Remediate. Hacktron starts a remediation run for the finding.

A finding from a pull request scan, with Remediate in its More actions menu

Review the fix

When the agent produces a fix, Hacktron commits it to a dedicated fix branch and opens a pull or merge request in the finding’s repository. Review and merge it as usual.

A fix pull request opened by Hacktron, describing the vulnerability, the fix, and how it was verified

Starting a remediation needs the Member role or above. Each finding gets only one run. If you select Remediate again while a run is active, Hacktron returns that run instead of starting a second one.

Where the fix lands

Hacktron picks the target branch for the fix automatically:

• When the finding comes from a pull or merge request that is still open, and its branch is in the same repository, the fix is opened against that branch. The fix becomes part of the change that introduced the issue.

• In every other case, the fix is opened against the repository’s default branch. That covers merged or closed source pull requests, branches from forks, and findings from Whitebox pentests.

If the source pull request merges while the agent is still working, the fix is retargeted to the default branch.

Outcomes

A remediation run ends in one of four states:

Runs started by an automation appear in that automation’s run history, with the credits each run used.

Run remediation automatically

An automation can remediate qualifying findings across repositories and applications on its own, and notify your team in Slack and by email.