How do you fix a vulnerable dependency with the Safeguard web app chat?

To fix a vulnerable dependency from the Safeguard web app, open the finding, ask Griffin in chat what it is and how to fix it, then use AI Remediate to generate a pull request. You review the proposed change, its breaking change rating and any test results before anything merges.

What do you need first?

An account at app.safeguard.sh and a project whose repository is connected and scanned, so findings exist. The web app runs in a current browser with no install. Griffin is Safeguard's own model for supply chain security and, according to the docs, is available across the products.

Know your policy before you start. Safeguard supports Full AI, Zero AI and bring-your-own-model setups, so what Griffin can do for you depends on how your organization configured model use. If AI features are turned off, the scan and finding data are still there, and you fix by hand.

How do you use chat to understand the finding?

Click the Griffin icon to open the chat interface. The documentation gives sample prompts such as "Explain CVE-2024-1234" for a detailed vulnerability analysis, "How do I fix this?" for step-by-step remediation guidance, and "What's our biggest risk?" for a prioritized list.

Good first questions for a single dependency:

• What does this vulnerability allow, and what do I need to be true for it to matter?
• Is the vulnerable code reachable from my project?
• What is the lowest version that fixes it?
• What changes between my version and that one?

Reachability is worth asking about. Griffin's prioritization considers whether the vulnerable code is actually called, how likely exploitation is, and environment context. A finding that is not reachable may be safe to schedule, and a reachable one may need a same-day fix. Treat the answer as input to your decision, and check the finding detail yourself.

How do you get the fix as a pull request?

The documented flow for a single vulnerability is four steps. Navigate to the vulnerability, click AI Remediate, review the proposed changes, then click Create Pull Request. You can also select several vulnerabilities and use AI Remediate Selected, or use the AI Remediate button on the Vulnerabilities page for a plan across everything fixable. For multiple repositories, pull requests are created one per repository.

The product description says the platform can be driven from chat as well. This walkthrough sticks to the documented buttons, and chat is where you gather the information to decide.

The generated pull request carries a title with the CVE reference, a description of the vulnerability, a summary of the changes, breaking change warnings if any, test results if configured, and links to advisories. Dependency upgrades include handling of transitive conflicts and lock file updates.

What should you review before merging?

Read the breaking change rating. The docs describe four levels: Safe, Minor, Major and Critical. They recommend reviewing major changes and say not to auto-merge breaking changes. Then check these:

• the lock file diff is limited to what you expect;
• your own tests ran, ideally through the test integration setting in AI Remediate settings;
• the fixed version matches what chat told you;
• the pull request description names the right advisory.

Settings under AI Remediate include Auto-Create PRs, Require Approval, Test Integration, Breaking Change Policy and Branch Naming. Review each before enabling automation. Start with approval required and tests on, and relax later if the results justify it.

Open the full demo

What are the limits?

Chat and AI Remediate do not replace testing. A generated fix can pass a thin test suite and still break behavior you did not cover. Some vulnerabilities have no fixed version yet, in which case the realistic options are a mitigation, a replacement package or a documented exception. And a finding marked unreachable today can become reachable after a code change, so rescan.

What to do

1. Open the finding in app.safeguard.sh and note severity, path and fixed version.
2. Ask Griffin in chat about reachability and the smallest safe upgrade.
3. Use AI Remediate on the vulnerability and read the proposed changes.
4. Check the breaking change rating and the lock file diff.
5. Create the pull request and let your tests and reviewers run.
6. Merge, then rescan to confirm the finding closes.
7. Keep Require Approval on until you trust the results for a class of fixes.

Quick check

Sources

• Safeguard docs: Griffin AI, fetched 18 October 2026
• Safeguard docs: AI Remediate, fetched 18 October 2026
• Safeguard docs: Web Application, fetched 18 October 2026

Last reviewed: 18 October 2026.