Skip to main content
Bunlong HengBack to the site
An AI That Ships Security Fixes Strangers Actually Merge
Claude CodeSecurityOpen Source

An AI That Ships Security Fixes Strangers Actually Merge

·2 min read

Every "AI finds vulnerabilities" demo I saw stopped at the fun part: it prints a scary finding and you clap. Nobody showed the boring part, landing the fix in someone else's repo with a maintainer clicking merge. That gap is the entire problem, so that is the part I built.

What it actually is

AI Security is a Claude Code skill plus a small SQLite database. Every hour a bot goes looking for work: it scans a set of seed repos and live GitHub search for security issues that are fresh (opened in the last 3 days) and unclaimed (zero comments). That window is the whole trick. Fresh and unclaimed is where a good PR gets merged instead of buried under 10 other opinions.

When it finds a candidate, the audit runs and the entire trail is written to SQLite, keyed by (repo, pr_number) - not just the fix, but the reasoning, the candidates it rejected, and talking points so months later I can explain any one of them without re-reading the diff.

The part I'm proudest of is the findings tournament. Every candidate fix gets ranked on 3 things: is it real, is it patchable, and would it actually merge. Losers don't get deleted - they stay in the DB with the reason they lost. Because most "findings" fail one of those 3, and the ranking is really the product.

In practice

Here's how a typical night goes. The hourly bot pulls fresh issues, scores each 0-100 on repo health, issue age, and maintainer activity, and a security bonus pushes the real ones up. The top candidate goes into an audit. The tournament throws out the finding that's technically true but unpatchable, and the one that's patchable but no maintainer would ever merge. What's left is a single, clean, scoped fix.

Then the rule that matters most: 1 PR per repo. Spraying 10 PRs at 1 maintainer is how you get blocked, not merged. So it opens 1, links the reasoning, and tracks the live GitHub status - open, merged, or rejected - right in the dashboard.

What I learned

The model finding a bug was never the hard part. Getting a stranger to trust a fix enough to merge it into their project - that's the part worth building, and it's 90% judgment about what not to send. The count I care about isn't findings. It's 92 PRs merged into real, popular open-source projects.