A fix that never ships is just a ticket. Auto-Fix is Safeguard's attempt to shorten the road from a finding to a change you can merge.
What it is
The product page describes remediation in two places. Fix left works in source code: it finds vulnerabilities, generates patches, and connects to the IDE for real-time fixes. Fix right works on deployed container images: it offers Gold container images with known CVEs remediated, screens for known malware, patches images automatically and keeps watching for newly disclosed CVEs.
The page lists three steps. Griffin AI runs transitive dependency analysis, Safeguard generates patches or offers replacement images, and your team deploys. The page labels the product Just Launched, and says the fixed Gold container images are rolling out in early access.
How to use it
- Run a scan and open a finding with a fix.
- Look at the proposed change as you would any pull request.
- Run your own tests. The ESSCM page says auto-fix pull requests open after your test suite runs for supported ecosystems.
- Merge on your usual review path. Auto-merge, if you want it, is a setting in the remediation docs.
What the page does not say
It does not say whether a person reviews a patch before it applies, and it does not list supported languages, package managers or registries. Do not assume either. Ask your administrator what is enabled for your tenant.
Quick check
What does fix right refer to?
Remediation in deployed container images.
