Automatic Remediation

Xygeni CLI provides automatic remediation for some of the vulnerabilities found by Xygeni Scanners. Automatic remediation is currently available for:

• Secrets (see Secrets Auto-Remediation), where xygeni secrets --auto-remediate revokes the leaked secret.

• SAST vulnerabilities, IaC flaws and CI/CD misconfigurations, where xygeni scan --auto-remediate hands the findings to the XygeniBot, which opens pull requests with the AI-generated fixes (see Xygeni Bot).

A fix can only be proposed when the finding is located in a file of the repository, which is the file the AI agent rewrites. This is the case of IaC flaws, reported on the template or manifest where they occur, and of the CI/CD misconfigurations found in pipeline definitions, workflow files or Dockerfiles. CI/CD misconfigurations reported against the repository or the CI/CD platform itself — branch protection, organization settings, or a policy file that does not exist yet — have no file to patch, so no pull request is created for them; the dashboard offers a remediation guide instead.

Nevertheless, CLI is not the only mechanism to provide automatic remediation. For Open Source vulnerabilities, Xygeni Web UI provides a useful functionality to automatic remediation.

Please, visit OSS Auto-Remediation for further information.