AURI Fix for Open Source

Fix CVEs 6.2x faster, without breaking changes

A single version change can cascade into breaking changes. AURI Fix weighs every option for each exploitable vulnerability and picks the fastest, least disruptive fix, automatically.
Book a Demo
Start Free Trial
Loved by security teams, painless for developers at:

How AURI Fix works

Stop working findings that can't be exploited
AURI Fix checks reachability, exploitability, severity, and deployment context before it recommends a fix. Findings that can't be reached are accepted and documented, so engineering time goes to real risk.
Get past the upgrades engineering won't take
Only 10% of reachable findings can be fixed by a safe upgrade. AURI Fix weighs upgrading, mitigating in code, patching, and replacing, then recommends the fix with the least effort, disruption, and maintenance.
Fix on your terms, with evidence
Let the policy engine open pull requests for your team to review, or let an AURI agent triage findings, choose the fix, and open the pull request for approval. Every change is reviewed before it merges.
“As much as we'd like to believe that fixing is always safe, we can't afford to bring instability into the system. Endor Labs helped us build a scalable remediation workflow that reduces risk of breaking changes.”
Travis McPeak
Travis McPeak

Security Lead, Cursor (Anysphere)

Safe remediation graphic showing upgrade risk analysis
Upgrade without breaking
Upgrade Impact Analysis finds the minimum upgrade that fixes the vulnerability and shows what it will break in your application before anyone starts the work.
Score each candidate upgrade High, Medium, or Low risk based on the functions, interfaces, and dependency conflicts likely to break.
Compare direct and transitive upgrade paths, including overrides and pins, alongside every vulnerability each path resolves.
Open merge-ready pull requests for low-risk upgrades in Java, Go, Python, .NET, and JavaScript.
Read the docs
Mitigate in application code and config
When the exploitable path runs through how your application uses a dependency, AURI Fix breaks it with a small change to your own code or configuration and leaves the dependency in place. Now in private beta.
Control inputs at the call site or change a configuration flag, typically in fewer than 10 lines, with a median pull request of 6 lines in testing.
Reach the findings upgrades can't: in Endor Labs research, 82% of reachable findings had a first-party remediation option, while only 10% could be fixed by a safe upgrade.
Ship each fix with a VEX report that records why the vulnerability is no longer exploitable, so downstream scanners can suppress the finding on evidence.
Read the blog
AURI Fix pull request that breaks the exploit path to a vulnerable dependency with a small change in application code
Endor Patches hero graphic showing patched dependency versions
Patch when you can't upgrade
Endor Patches backport the upstream security fix to the version you already run, so teams close critical CVEs when an upgrade is blocked.
Resolve vulnerabilities in transitive dependencies that sit outside the application team's direct control.
Audit exactly what changed: each patch is minimal and built as a hermetic, reproducible artifact with SLSA Level 3 provenance.
Turn on auto-patching to apply patched versions on the next build, with no code or manifest changes.
Learn more
Replace risky dependencies
When the dependency itself is the liability, Endor Scores helps teams swap in a healthier alternative or remove the functionality that requires it.
Flag unmaintained, repeat-offender, and barely used dependencies before they generate the next round of CVEs.
Compare alternatives on Endor Scores for security, activity, popularity, and code quality.
Check candidate packages for vulnerabilities, malware, and maintainer health before they enter the codebase, including packages chosen by AI coding agents.
Read the docs
Endor Scores graphic rating an open source component on security, activity, popularity, and operational factors
Flowchart showing integration paths from GitHub, GitLab, and PHP to Slack and Microsoft platforms, with a C# icon connected to Slack.

Your Tools, Your Languages
— All Secured

Learn how Endor Labs fits into your ecosystem.
Learn More
Flow diagram connecting software development tools and platforms including .NET, JetBrains, GitHub, Google, and Vercel.

Related Resources

Give Devs the Confidence to Fix: Making Remediation Less Painful
Read the blog
Illustration of a hand holding an ace card placing it on a house of cards with text 'Dependency Management Report'.
Dependency Management Report
Read the report
When you can't upgrade: open source examples of Endor Patches
When you can't upgrade: open source examples of Endor Patches
Read the blog

FAQs

What is AURI Fix for Open Source?

AURI Fix brings four remediation options for open source vulnerabilities under one decision engine: upgrade the dependency, mitigate in your own code, patch the dependency, or replace it. It assesses reachability and exploitability in the context of your application, then recommends the option with the least effort, disruption, and maintenance.

How does AURI Fix decide which fix to use?

It works through a decision tree for each finding. If the vulnerability isn't reachable and exploitable, it accepts and documents the risk. If a safe upgrade exists, it opens a pull request. If the exposure comes from a configuration setting or from how your code uses the library, it applies a mitigation in your code. If the upgrade is blocked, it applies an Endor Patch. If the dependency itself is the problem, it uses Endor Scores to recommend a replacement.

How is mitigating in code different from patching?

A code mitigation changes your application, not the dependency. It controls an input or changes a configuration setting so the vulnerable function can't be exploited, typically in fewer than 10 lines. Endor Patches change the dependency itself by backporting the upstream security fix to the version you already run. Code mitigation is in private beta.

Will a fix break my application?

Upgrade Impact Analysis scores the risk of each upgrade before work starts, code mitigations have a median size of 6 lines, and Endor Patches contain only the security fix. Every fix arrives as a pull request or a patched version that your team reviews and tests before it ships.

Our scanners will still flag the vulnerable version. How do we handle that?

A code mitigation leaves the vulnerable version in place, so AURI Fix generates a VEX report with each fix that records why the vulnerability is no longer exploitable. Downstream scanners and your customers' security teams can suppress the finding based on that evidence.

How do teams put fixes into production?

Run AURI Fix from the Endor Labs CLI with endorctl fix, then choose a workflow. With policy-based workflows, the Endor Labs policy engine opens a pull request for your team to review, test, and merge. With agentic workflows, an AURI agent triages which findings to fix first, chooses the remediation method, applies the fix, and opens the pull request for your approval.

Code without compromise

Book a Demo
Start Free Trial