DepWatch: Autonomous DevSecOps Vulnerability Triage & Auto-Remediation Daemon
An automated DevSecOps daemon that continuously monitors GitHub Dependabot alerts across engineering repositories, classifies CVE severities, detects breaking major version jumps, applies verified dependency overrides, executes sandboxed test suites, and opens auto-merging pull requests.
Security Operations Center (SOC) Incident Triage
DepWatch scans open Dependabot advisories, detects breaking semver leaps, injects verified AST overrides, runs test suites, and opens auto-merging PRs.
Server-Side Request Forgery (SSRF) in Axios
Follows malicious protocol redirects when relative URLs are supplied in request configurations.
Denial of Service via Unchecked WebSocket Frames
Memory exhaustion when handling oversized fragmented WebSocket continuation frames.
Entropy reduction vulnerability in legacy NanoID
Upgrade requires pure ESM refactor and synchronous API changes. Blocked by breaking-change guard.
Header leakage on cross-domain redirects
Parked with documented audit justification. Risk score below SLA remediation threshold.
Branch: depwatch/auto-fix-2026-10-17 into master
The Enterprise Challenge
Engineering teams suffer from severe security alert fatigue. Hundreds of Dependabot alerts sit unaddressed in backlogs, exposing production applications to known CVEs because developers lack the time to manually bump lockfiles, verify builds, and cut PRs for non-breaking patches.
The Architectural Solution
DepWatch executes an automated triage and repair loop. It connects to the GitHub REST & GraphQL APIs to poll open security advisories. Alerts are categorized: Critical, High, and Medium vulnerabilities with available patches are routed to the fixer; low-severity and unpatched advisories are parked with documented audit justifications. The fixer clones the repo, applies AST package.json overrides or pip bumps, runs test and build verification, and autonomously submits pull requests with auto-merge enabled for green test suites.
Key Architectural Differentiators
Zero-touch dependency remediation: verifies real unit test suites before auto-merging pull requests.
Major version leap protection prevents breaking API changes from crashing downstream production workloads.
Complete historical audit trail in SQLite with a built-in dark-mode Express dashboard and weekly compliance reporting.