Security that ends in a merged fix
Coroid finds vulnerable dependencies, leaked credentials and vulnerable code in your repositories, keeps them in one list, and opens the pull requests that fix them. Your team reviews and merges.
Finding is no longer the hard part
AI models now find vulnerabilities faster than people can fix them. What matters is how quickly a confirmed fix is merged and running.
Anthropic's Project Glasswing reported more than 10,000 high and critical vulnerabilities in its first seven weeks.
Source: Help Net Security, 26 May 2026By 2 October 2026, maintainers had patched 516 of the 6,157 vulnerabilities Project Glasswing had disclosed.
Source: Project Glasswing patch gapThe Cloud Security Alliance cites 28.3% of CVEs exploited within 24 hours of disclosure.
Source: Cloud Security AllianceOpenAI's Daybreak takes the same view: validate findings in an isolated environment, generate patches for review, and leave people in control of what is applied.
Source: OpenAI
These figures are those programs' and researchers' results, not Coroid's. They are why Coroid's Security is built to fix, not only to find.
Every lockfile, matched within the hour
Coroid keeps an inventory of every package each project installs and matches it against new advisories within an hour of their reaching our advisory feed. Where a file cannot be read completely, coverage says so.
Vulnerable dependenciesEvery change checked for leaked keys, made-up packages and removed guards
Each pull request, and every change Coroid's own agents make, is checked for credentials, for packages that do not exist or are reported as malicious, and for removed access checks. What a change introduces shows on its checks, before anyone merges it.
Code scanning and security reviewHow it decides
- No silent green
- A clean result counts only from a complete scan. Partial coverage, a lost permission or delayed advisory data is shown, never read as fixed.
- Private by default
- Details of a vulnerability that is not public stay in Coroid until someone with the authority discloses them.
- People merge
- Coroid opens pull requests. Your team decides what merges, and exceptions are decided by owners, never by a change under test.
- Credentials stay untouched
- Coroid never keeps a credential it finds, and never tries one to see whether it works.
On every plan
Security is on every plan, Free included. Checks that use no AI model cost neither credits nor agent hours. Fixes, and the audit once you switch it on, spend agent hours like any other work.
Plans and pricingRead the guides
What each protection does, what it does not cover yet, and how to make GitHub require its check.
- Security
What Coroid's Security destination watches in your code and its supply chain, what it does about what it finds, and what it costs.
- Protections and enforcement
How each Security protection is switched on, what observe and enforce mean, and why enforcing waits for a readiness gate.
- Findings and their lifecycle
How Security keeps one list of findings, when a finding opens and closes, fixed in code versus fixed where it is deployed, and how exceptions work.
- Vulnerable dependencies
How Security inventories each project's packages, matches them against published advisories, which lockfiles it reads completely, and what the Coroid Security check does on a pull request.
- Fix pull requests
How Coroid turns a vulnerable dependency into a reviewed upgrade pull request, what pays for it, what the pull request carries, and how code and secret findings are fixed.
- Leaked secrets
How Security finds credentials in changes and in your history without keeping them, why a leaked secret closes only when someone attests it was rotated, and how to fix one.
- Disclosure
How Coroid keeps the details of a vulnerability that is not public inside Coroid, what may appear on GitHub, in notifications and in exports, and how private fixes are published.
- GitHub permissions and the Coroid Security check
Which GitHub App permissions Security uses and why, how the Coroid Security check behaves, how to require it, and how GitHub's own security alerts are imported.