The pipeline
From vulnerability discovered to PR merged, under 10 minutes.
Repohelm indexes your dependency manifests and lockfiles, applies your governance policy against each finding, and opens targeted fix PRs with the CVE summary and reachability analysis already written. Your team reviews or auto-merges. No separate dashboard to check.
The Repohelm pipeline, step by step
Repository indexing
On installation, Repohelm indexes your dependency manifests and lockfiles across all connected repos. Subsequent scans are incremental, only changed files re-parsed.
CVE matching and AI triage
Each dependency version is matched against the NVD, OSV, and GitHub Advisory Database. Repohelm's AI triage layer scores by reachability in your specific codebase. A CVE in a dev-only dependency gets a different urgency than one in a production-critical path.
Policy evaluation
Your governance policy runs against each finding. You control: severity thresholds, allowed licenses, version pinning rules, auto-merge eligibility, and notification routing.
PR generation
For each violation, Repohelm opens a pull request with: the exact version bump, a CVE summary, the reachability analysis, and the change diff. PR title and description are written by AI in the style your team prefers.
Auto-merge or review
Low-risk patch bumps that pass all policy checks can be auto-merged immediately. High-severity or breaking changes route to your review queue with full context.
Works with your existing stack
Repohelm does not replace your code host or your incident tooling. It connects to them via webhook and writes fix PRs back through the same interfaces your engineers already use.
Policy as code
Policy that lives in your repo
One .repohelm.yaml at the root of your organization defines severity thresholds, license allowlists, pinning rules, and auto-merge eligibility. It is version-controlled, reviewed in PRs, and enforced consistently across every repository. A Confluence page is documentation. This is policy.
version: "2"
policy:
severity_threshold: CRITICAL
auto_merge:
enabled: true
max_severity: MEDIUM
licenses:
deny: [GPL-3.0, AGPL-3.0]
warn: [LGPL-2.1]
notifications:
slack: "#security-alerts"
pagerduty: trueConnect your first repository. Get your first fix PR in under 5 minutes.
Free for up to 5 repositories. No credit card required.