The shift that patches your deps while you sleep.
Nightly triage, CI-validated fix PRs, and a Monday digest your CTO will actually read. Bracework watches your npm, pip, and Cargo lockfiles, drafts the smallest fix that closes each advisory, and only opens a pull request when the branch is already green on CI.
Sample output from a real nightly run. No fictional dashboards — just the log lines that drive the work.
Push-based bots are why your reviewers stopped reading the PR list.
Platform teams already pay for an SCA platform that talks about reachability and ownership graphs. The PRs still pile up. The dashboards still go unread. What is missing is a scheduler-driven, CI-validated, and calmly-summarized closing of the loop.
A queue, not a push
Findings batch overnight. Reviewers see one item per night, not eighty per hour.
Green before review
Every patch runs through your CI on a branch. If it fails, you never see the PR.
A digest you actually read
Monday morning summary for engineers, security owners, and compliance — in plain English.
Six steps. One human gets a single email Monday morning.
Bracework runs once per night per repo. It does not poll. It does not race. It produces the smallest change that closes the advisory, validates it, then files it.
- 01Ingest
Pull advisories
OSV, GHSA, vendor feeds. De-duped across your npm, pip, and Cargo lockfiles.
- 02Score
Reachability + exploit
Filter out advisories that could not reach your code, even if the dep is present.
- 03Draft
Smallest fix
A version bump, a codemod, or a vendor advisory pin. Never a drive-by refactor.
- 04Validate
Run your CI
The branch must be green. If CI fails, the PR is not opened — we try the next candidate.
- 05Open
Single PR per night
Auto-merge where allowed. One reviewer. Notes link the advisory and the CI run.
- 06Digest
Monday digest
A short email for engineers, security, and compliance. Escalations at the top.
We sit on top of your scanner, not against it.
vs Dependabot / Renovate
Push → review, every hour
Bracework: Nightly batch → green branch, one PR
vs Snyk / Socket / Endor Labs
Find. Dashboards. Remind.
Bracework: Find + ship. Audit trail. Plain English.
vs AI fixer agents
Auto-commit, hope CI canary catches it
Bracework: Branch first, validate, then open PR
Bracework is not trying to replace your scanner. It is the calm remediation layer that turns its output into merged pull requests and a Monday summary your CTO will read on the train.
One email. Four inboxes. No dashboard.
A weekly plaintext digest turns the reconciled PRs into a short note your CTO, security owner, and compliance lead can each read in under sixty seconds — with the PRs, advisories, and CI status linked in the same email.
- Per-repo section with the week’s merged fixes and open PRs.
- Each entry links the PR, the advisory, and the CI run that validated it.
- Escalations are called out at the top in a single sentence — never buried.
- Plain English, one paragraph; no metrics invented for the sake of dashboard.
Heads up: one breaking change escalated for a human call (lines 28–34). Everything else is ready to merge.
Prototype pollution in lodash via transitive path
4.17.20 → 4.17.21 · PR #2214 · CI 312 tests
Key-confusion in PyJWT (CVE-2024-53861)
1.7.1 → 2.8.0 · PR #2215 · CI 312 tests
RUSTSEC-2024-0439 — yanked crate `paste`
awaiting sponsor review · PR #2216
Webpack 5.88 → 5.97 (major bump, 14 transitive changes)
needs human judgement — opened Monday only for you
The skeptical-reader FAQ.
If something on this list is on your mind, write to us at bracework-2@polsia.app.
Give us one repo. We’ll hand you a Monday digest by week two.
The pilot installs the GitHub App on a single repo, runs for one week, and delivers a sample digest so you can see the format before you commit to a wider rollout.
We reply from bracework-2@polsia.app within one business day.