Skip to main content

​
Overview

OpenSRE can turn one GitHub security or quality finding into a local fix and, when approved, a pull request. It supports Dependabot alerts, code-scanning/CodeQL alerts, and GitHub Code Quality standard findings.
This is mutating. OpenSRE asks before editing files, then asks again before committing, pushing, and opening a PR.

​
Prerequisites

  • Local checkout whose origin matches the finding repository
  • GitHub token with the access listed under Credentials
  • Optional coding-agent CLI (Pi, Claude Code, Codex, or Cursor) for findings that need broader reasoning

​
Setup

There is no dedicated integrations setup target for this tool. Connect GitHub in the OpenSRE app with repository write and security-alert read access. Configure the workspace:
OpenSRE has built-in local fixers for some Code Quality findings, such as unused imports and unused local variables. For findings that need broader code reasoning, it automatically uses the first coding agent CLI it finds installed and logged in: Pi, Claude Code, Codex, or Cursor. No configuration is needed when one of those CLIs already works on your machine. To pin a specific agent instead of auto-detection:

​
Credentials

​
Tools

Related skill: fixing-github-security-alerts.

​
Use it

In the interactive shell:
For a broad repo request, OpenSRE selects one open supported finding by severity, skipping findings that already have an open OpenSRE fix PR. When nothing is left, it reports that no PR was needed. If you do not name a repo, it uses the current checkout’s GitHub origin. For a specific alert, include the alert URL or say the alert type and number:
OpenSRE asks before editing files, then asks again before committing, pushing, and opening the PR.

​
What happens

  1. OpenSRE reads the GitHub alert or Code Quality finding details.
  2. It verifies the local checkout’s origin matches the finding repository.
  3. OpenSRE first tries a built-in local fixer when one safely applies.
  4. If no built-in fixer applies, OpenSRE runs the auto-detected (or pinned) coding agent CLI to implement the fix in the local checkout.
  5. If PR shipping is requested and approved, OpenSRE commits only the files the fix run changed, pushes an opensre/github-security-fix-* branch, and opens a PR into the default branch.
Secret-scanning alerts are not auto-fixed. Revoke or rotate the secret first, then plan repository cleanup separately.

​
Scheduled fixes on public repositories

A scheduled loop that opens PRs on a public repository should pass quality_only=true. OpenSRE then fixes only code-scanning and Code Quality findings without a security severity, so a vulnerability fix is never published in a public PR before you can handle it privately.

​
Verify

There is no dedicated integrations verify target. Confirm readiness by:
  1. An authorized GitHub connection in the OpenSRE app with the scopes above
  2. Local checkout origin matches the target repository
  3. A coding agent CLI is available when built-in fixers do not cover the finding

​
Troubleshooting

​
Security

  • Dual confirmation when shipping: edit first, then commit/push/PR.
  • PR branches use the opensre/github-security-fix-* prefix.
  • Store tokens in .env or your secret manager — not in source control.