Remediation workflow¶
Remediation in SQUR runs as a loop: find, fix, verify.
- Find: a pentest confirms a finding with proof.
- Fix: you ship a fix, by hand or from a draft pull request SQUR prepares.
- Verify: you retest the finding. A passing retest closes it.
Where to work¶
Open Findings in the sidebar and select a finding, or open a run and use its findings list. Each finding carries fix guidance for your engineers.
Autonomous fixes (whitebox)¶
For apps with connected source code, SQUR can prepare a fix for a finding and deliver it to your repository. The Autonomous fix section in the finding details shows where it stands:
| Status | What it means |
|---|---|
| Drafting a fix | A fix is being prepared. |
| Draft pull request opened | A draft pull request is waiting in your repository for a person to review and merge. |
| Fix branch pushed | The repository is set to branch only. Review and merge the branch yourself. |
| Pull request merged / closed | You merged it, or closed it without merging. |
| No automated fix | The finding needs a design decision, or no valid fix could be drafted. Fix it by hand. |
SQUR never merges a fix. Your existing CI runs on the draft pull request when it opens, and a regression test for the weakness is included where one applies. The finding stays open until a retest confirms it is closed.
Turn it on¶
Autonomous remediation is opt-in on two levels, and a fix is delivered only when both are on:
- Organization: allow fix preparation in your organization settings.
- Repository: on the app's repository card, switch on Deliver fixes to this repository and choose the delivery method: Draft pull request (default) or Branch only.
Availability depends on your account. If delivery is not yet enabled for you, your settings are saved and apply once it is.