Launching today
Mendr
Track, group and fix your team's CVEs before they're due
3 followers
Track, group and fix your team's CVEs before they're due
3 followers
Mendr puts the vulnerable dependencies from all your GitHub repos in one queue, grouped by package, each with an SLA due date and an owner. Press Fix and it opens a tested PR, changing your code if needed. You merge, and you keep the record for your SOC 2 audit.
Free Options
Launch Team / Built With
CloudflareYour next app belongs on Cloudflare Workers. Deploy for free
Promoted
Hey Product Hunt, I'm Arjan. Mendr started with a problem at my day job.
We had a careful process for vulnerable dependencies. We're audited for SOC 2, so our security policy sets a deadline for each severity, and the auditor checks that we met them. Each Dependabot alert got a due date from that policy and its own Jira ticket.
It was hard to keep up with, though. A package with five CVEs meant five tickets. And every fix meant a developer stopping what they were doing to bump the version, read the changelog, run the tests and fix whatever broke.
The first thing I tried was asking an agent to fix the CVEs. That worked, one repo at a time. But I still couldn't easily tell which ones were due this week, who had them, or whether they'd actually been fixed, and that's exactly what the auditor asks about.
So Mendr does the tracking and the fixing together:
All your repos feed one queue. The CVEs on one package become one finding, with one PR and one Jira ticket.
Each finding gets a due date and an owner. The date comes from your SLA policy (7 days for critical and 30 for high by default, or your own). The Jira ticket opens when someone starts the fix, and your template decides who gets it.
Slack sends a digest of what's overdue or due soon, and tells the team when a PR is ready to review.
The Incidents page answers "are we affected?" when a big CVE or a poisoned package makes the news. It checks the story against your latest scans and names the repo, file and version. From there you fix it like any other finding.
After you merge, Mendr scans again and records that the CVE is gone. The impact report shows how much you fixed within your SLA, and you can export the record for your audit.
When someone presses Fix, Mendr upgrades the package in a fresh sandbox, changes the code if the upgrade breaks it, runs your build and tests, and has a second AI review the change. Then it opens a draft PR that says what ran and what's still open. Your CI runs, and a person on your team merges it. Mendr never merges anything.
Here's the fix from the video. lodash 4.17.20 had five advisories, and Mendr showed them as one finding with one due date. One press of Fix took 2m 38s, passed 13 of 13 tests and opened one PR.
It's free for 5 repos, with 5 fixes on any model. Pro is $20/mo for 50 repos, your own SLA policy, Slack and Jira.
I'm curious how other teams do this. Who owns the vulnerability backlog at your company? A person, a team, or a Slack channel?