AI Remediate in Safeguard analyzes a vulnerability, picks an upgrade path, checks for breaking changes and opens a pull request. Your job is to review that pull request, not to trust it blindly. The docs describe this flow in the platform, and they do not describe a mobile workflow.
How does AI Remediate work?
The documentation lists five steps. Griffin AI reviews the vulnerability and your codebase. It selects the safest upgrade path. It assesses impact, including breaking changes and compatibility. It opens a pull request. Then automated tests run to validate the fix, if the test integration is enabled.
The pull request carries a CVE referenced title, a description of the vulnerability, a summary of changes, breaking change warnings, test results where configured, and links to advisories. With bulk remediation you get one pull request per repository.
What can it change?
The docs name three kinds of change: dependency upgrades, including transitive conflicts and lock file updates, configuration fixes such as security headers and insecure defaults, and code modifications such as replacing deprecated functions, which apply only in some cases.
Full support is listed for npm, yarn and pnpm, pip, poetry and pipenv, Maven and Gradle, Go, Cargo, Bundler, NuGet and Composer.
What are the limits?
Each fix is rated Safe, Minor, Major or Critical, and Critical fixes need manual review. Only some vulnerabilities qualify for code changes. Test validation only runs if you enabled it. Settings let you auto create pull requests or require approval first, and the docs recommend reviewing major changes rather than auto merging.
Where do the iOS and Android apps fit?
The download page lists an iPhone and iPad app on the App Store and an Android app on Google Play, and it does not label either one beta. The AI Remediate documentation does not mention mobile, so we do not describe steps for reviewing a fix on a phone. Use the web platform, CLI or your Git host for the review, and treat anything else as unconfirmed until it is documented.
What should you review in the pull request?
Look at the version jump first. A patch release is a different risk from a major release. Read the breaking change notes and the changelog of the library, then check that the lock file changed only where expected.
Next, look at the tests. Green tests help only if they exercise the code path that uses the library. If coverage is thin, add one test that calls the upgraded function before merging.
Finally, confirm the finding was real for your code. Reachability analysis helps you decide whether the vulnerable function is actually called, which tells you how fast you need to move.
What to do
- Open the finding and read the CVE and the proposed version.
- Check the risk rating on the fix.
- Read the pull request description and breaking change notes.
- Confirm the test integration ran, or run tests yourself.
- Add a test for the library call if coverage is thin.
- Require approval for Major fixes and keep Critical fixes manual.
- Merge and confirm the finding closes on the next scan.
Quick check
Does AI Remediate merge automatically?
The documented settings include auto creating pull requests or requiring approval before they open. The docs recommend reviewing major changes rather than auto merging.
Can I do this from the mobile app?
The AI Remediate documentation does not describe a mobile workflow, so use the web platform, CLI or Git host.
Sources
Last reviewed: 18 October 2026.
