Find and Fix Vulnerabilities in Open-Source Dependencies

Aikido Autofix is a tool you can use to have Aikido fix vulnerabilities in 3rd party dependencies in your projects. It will do this by creating pull requests that remove the vulnerability via package updates or by other means. In some cases an Aikido Autofix can remove a whole class of vulnerabilities instead of just 1 issue.

Aikido checks the standard databases—NVD and GitHub Advisory Database (GHSA)—but goes further. Aikido Intel uncovers silently patched vulnerabilities and vulnerabilities without CVEs.

Aikido checks if you're using the vulnerable function. If not, it's clearly a false positive and it's automatically triaged.

The npm ecosystem is susceptible to malicious packages being published because of its open nature. Aikido identifies malicious code that may be embedded within JavaScript files or npm packages. Powered by Aikido Intel.

‍_{(Scans for backdoors, trojans, keyloggers, XSS, cryptojacking scripts and more.)}

Security audits typically require providing an SBOM. Aikido makes it easy to analyze this list in advance & generate it whenever required. You're also able to create an SBOM of containers. Aikido supports cycloneDX and SPDX.

No need to do CVE research. Aikido gives you the TL;DR, tells you how you're affected & how you can most easily remediate security issues or even auto-fix them.

Aikido reports duplicate vulnerabilities as a single issue. Unlike other scanners that flood you with alerts, Aikido notifies you only when a known fix exists.

Aikido automates technical vulnerability management controls, making SOC 2 and ISO 27001 compliance much easier.