Last updated:
Security checks and verification
GuardFix is a beta security product for SaaS and small product teams. It combines project-file checks for vulnerable dependencies, possible exposed secrets, unsafe code patterns and configuration issues with AI-assisted explanations. Its remediation agent currently prepares npm dependency updates, which a separate verifier checks before engineering review.
This page describes the project analysis and npm remediation workflow shown in guided demos and scoped pilots. Supported files, access, checks and engineering support are agreed for each project. It does not describe a penetration test or certify an application as secure.
What the project checks look for
Dependency vulnerabilities. Supported project manifests and lockfiles are checked for package versions covered by known advisories. A package match identifies something to investigate; it does not establish whether an affected feature is reachable or exploitable in your application.
Possible exposed secrets. Secret detection looks for supported credential patterns in project files. A match needs investigation. If a credential is live and exposed, revoke or rotate it and investigate access; removing the string from a file does not invalidate the credential.
Unsafe code patterns. Static rules flag selected patterns that deserve a code review. Review the input source, execution path and surrounding controls before treating a pattern match as a confirmed vulnerability.
Configuration issues. Supported configuration files are checked for security-relevant settings. Findings need to be interpreted in the context of the deployment and its intended access model.
The current analysis pipeline uses Trivy, Gitleaks and Opengrep, together with GuardFix rules and an AI explanation layer. Scanner coverage and available checks depend on the submitted project.
How an npm dependency update is verified
The agent proposes a dependency update. A separate verifier evaluates the resulting project rather than relying on the agent's explanation of its own changes. The verification workflow checks a clean installation, the target vulnerability findings, the build and the project's tests.
Passing these checks provides evidence about that update under the recorded conditions. It does not prove the absence of unrelated vulnerabilities or guarantee production compatibility. Failed or unavailable checks must remain visible, and a skipped test is not a passing test. An engineer reviews the evidence and agrees the next steps with you; production changes require your approval.
What to keep in a useful report
Record the project version and agreed scope, the checks that completed, checks that failed or could not run, and the evidence for each finding. Keep scanner findings separate from AI explanations and suggested changes. For remediation, retain the proposed update and verification results so an engineer can review them.
A completed scan with no findings is different from an incomplete scan. Both can miss issues. Our illustrative security report shows how to describe a possible credential, dependency advisory and code pattern without claiming confirmed exploitability.
Where other security work is needed
Project-file scanning does not cover every runtime behaviour, authorisation decision, business-logic flaw or infrastructure risk. Depending on your application and threat model, you may also need a penetration test, runtime assessment, architecture review or specialist security advice. AI explanations can be wrong and do not replace review of the original evidence.
How to start a pilot
A public open-source repository or a dedicated sample is a practical starting point. Do not put live credentials, personal datasets or confidential source code in a demo request. Private project access and any paid work need a separately agreed scope.
Request a guided demo to discuss your project, supported inputs and expected outcome. Requesting a demo does not start a subscription. For product questions, contact [email protected]. See operator information and the privacy notice.