Features

Auto-Remediation

Overview

Auto-remediation is Pensarā€™s most powerful feature - the ability to automatically fix identified security vulnerabilities in your codebase. When source code access is provided, Pensar can map vulnerabilities to specific code locations, generate fixes, verify those fixes work, and optionally create pull requests automatically.

Auto-remediation is available for applications with source code access via VCS integration (GitHub, GitLab, Bitbucket) or uploaded zip files.

How Auto-Remediation Works

The auto-remediation process follows a systematic approach to ensure fixes are correct and effective:

1

Vulnerability Discovery

During hybrid testing, Pensar identifies a security vulnerability with precise code location (file, function, line number).

2

Map to Source Code

The vulnerability is mapped to the exact location in your source code, including:

  • Affected files and line numbers
  • Surrounding code context
  • Data flow analysis
  • Root cause identification
3

Plan a Fix

AI analyzes the vulnerability and plans an appropriate remediation:

  • Identifies the vulnerability type and pattern
  • Considers your code style and conventions
  • Selects the most appropriate fix strategy
  • Plans minimal code changes to resolve the issue
4

Apply the Fix

The planned fix is applied to your source code:

  • Code is modified using best practices
  • Additional security controls are added if needed
  • Comments are added explaining the security fix
5

Verify with POC

The previously generated proof-of-concept (POC) is re-run against the fixed code to verify:

  • The vulnerability is actually resolved
  • The fix doesnā€™t break functionality
  • No new vulnerabilities were introduced
6

Loop Until Complete

If verification fails, the process repeats:

  • Analyze why the fix didnā€™t work
  • Generate an improved fix
  • Re-verify until successful

This iterative approach ensures fixes are correct before being committed.

7

Create Pull Request

If auto-PR creation is enabled in your workspace settings, Pensar:

  • Creates a new branch with the security fix
  • Commits all changes with detailed commit messages
  • Opens a pull request in your VCS (GitHub, GitLab, or Bitbucket)
  • Includes PR title and description with vulnerability details
  • Links back to the Pensar Console for full context

Pull request creation is controlled under Settings ā†’ Automation ā†’ Remediation via the Auto Open PRs toggle. The Patching section unlocks once youā€™ve connected a repository, and lets you set the minimum severity that triggers a PR and whether PRs open as drafts.

Supported Vulnerability Types

Auto-remediation works for a wide range of security vulnerabilities:

Automatically fix injection attacks including:

  • SQL Injection: Implement parameterized queries or prepared statements
  • XSS (Cross-Site Scripting): Add proper output encoding and sanitization
  • Command Injection: Sanitize inputs and use safe APIs
  • LDAP Injection: Implement proper escaping
  • XML Injection: Add XML parsing safeguards

Fix authentication and access control issues:

  • Broken Authentication: Strengthen authentication mechanisms
  • Insecure Password Storage: Implement secure hashing (bcrypt, Argon2)
  • Missing Authorization Checks: Add proper authorization validation
  • Privilege Escalation: Implement principle of least privilege
  • Insecure Session Management: Fix session handling and expiration

Prevent sensitive data leaks:

  • Sensitive Data in Logs: Remove or redact sensitive information
  • Information Disclosure: Remove debug information from production
  • Insufficient Encryption: Implement proper encryption
  • Insecure Data Storage: Add encryption at rest
  • Excessive Data Exposure: Limit API response data

Correct configuration issues:

  • Default Credentials: Remove hardcoded credentials
  • Insecure Defaults: Apply security hardening
  • Verbose Error Messages: Implement generic error responses
  • Missing Security Headers: Add security headers
  • CORS Misconfigurations: Restrict origins appropriately

Fix cryptography vulnerabilities:

  • Weak Cryptographic Algorithms: Upgrade to strong algorithms
  • Hardcoded Secrets: Move secrets to secure storage
  • Insecure Random Number Generation: Use cryptographically secure RNG
  • Insufficient Entropy: Improve randomness sources

Address application logic vulnerabilities:

  • Race Conditions: Add proper locking mechanisms
  • TOCTOU Issues: Implement atomic operations
  • Price Manipulation: Add server-side validation
  • Workflow Bypass: Strengthen state validation
  • Mass Assignment: Implement allowlists for parameters

Automatic Pull Request Creation

When configured, Pensar can automatically create pull requests with security fixes:

PR Configuration Options

Configure automatic PR creation for GitHub repositories:

  • Auto-create PRs: Enable/disable automatic PR creation
  • Target Branch: Specify branch to create PRs against (usually main or develop)
  • PR Labels: Apply labels like security, automated-fix, pensar
  • Severity Filter: Only create PRs for vulnerabilities above a certain severity
  • Require Review: Optionally require manual review before merging

PRs include:

  • Detailed vulnerability description and severity
  • Code changes with before/after comparison
  • Proof-of-concept that was used for verification
  • Explanation of the fix and why it works
  • Link to the Pensar Console for more details

Example Pull Request

A typical auto-remediation PR includes:

1## šŸ”’ Security Fix: SQL Injection in User Login
2
3**Severity**: High
4**CWE**: CWE-89 (SQL Injection)
5**Pensar Scan**: [View Details](https://console.pensar.dev/pentests/abc123)
6
7### Vulnerability Description
8
9An SQL injection vulnerability was discovered in the user login endpoint.
10User input is concatenated directly into SQL queries without parameterization,
11allowing attackers to inject malicious SQL code.
12
13### Affected Code
14
15File: `src/auth/login.ts`
16Lines: 45-47
17
18### Fix Applied
19
20Replaced string concatenation with parameterized queries using prepared statements.
21This prevents user input from being interpreted as SQL code.
22
23### Verification
24
25The security fix was verified by re-running the proof-of-concept exploit.
26The vulnerability is now resolved and the application properly rejects malicious input.
27
28---
29
30šŸ¤– This PR was automatically generated by Pensar

Remediation Workflow

Manual Review Workflow

For teams that prefer manual oversight:

1

Receive Notification

Get notified when a vulnerability is found and a fix is available.

2

Review in Console

Examine the vulnerability details, fix, and verification results in Pensar Console.

3

Approve Auto-Fix

If the fix looks correct, approve it to create a pull request.

4

Code Review

Review the pull request like any other code change.

5

Merge

Merge the PR to deploy the security fix.

Automated Workflow

For teams that want maximum automation:

1

Continuous Scanning

Pensar continuously scans your code for vulnerabilities.

2

Automatic Fixing

When vulnerabilities are found, fixes are generated and verified automatically.

3

Auto-PR Creation

Pull requests are created automatically for approved severity levels.

4

Optional Auto-Merge

For low-severity fixes, optionally enable auto-merge after CI passes.

We recommend manual review for High and Critical severity vulnerabilities, even with automated workflows enabled.

Configuration Options

Auto-remediation is configured under Settings ā†’ Automation ā†’ Remediation (the Patching section unlocks once a repository is connected):

Auto Patch Generation

Toggle whether Pensar automatically generates and verifies fixes for the issues it finds.

Auto Open PRs

Toggle whether verified fixes are opened as pull requests in your connected VCS. When enabled, you can also set:

  • Minimum severity ā€” only issues at or above this severity open a PR.
  • Open as draft ā€” open PRs in draft state for review before theyā€™re marked ready.

Notifications

Remediation and pentest activity can be delivered by email to workspace members and through the Slack integration. Configure these under Settings ā†’ Integrations ā†’ Notifications.

Limitations and Considerations

Some complex business logic vulnerabilities may require manual review:

  • Fixes that impact multiple interconnected systems
  • Changes requiring business rule validation
  • Modifications to critical authentication logic

In these cases, Pensar provides detailed remediation guidance but may not auto-fix.

Auto-remediation aims for non-breaking fixes, but some security fixes may require:

  • API contract changes
  • Database schema modifications
  • Updated client code

These are flagged for manual review with migration guidance.

While Pensar verifies fixes using generated POCs, we recommend:

  • Running your existing test suite
  • Validating fixes in staging environments
  • Monitoring production after deployment

In rare cases, Pensar may generate unnecessary fixes:

  • Review automated PRs before merging
  • Report false positives to improve accuracy
  • Configure severity filters to reduce noise

Best Practices

When first enabling auto-remediation:

  1. Require manual approval for all fixes
  2. Review several PRs to build confidence
  3. Gradually increase automation level
  4. Enable full automation for low-severity issues first

Deploy fixes to staging before production:

  • Test auto-remediation fixes thoroughly
  • Validate functionality isnā€™t broken
  • Monitor for unexpected behavior
  • Only then merge to production

Ensure good test coverage:

  • Automated tests catch regressions
  • Tests verify fixes donā€™t break functionality
  • CI/CD pipelines validate PRs automatically

Continuously improve your remediation process:

  • Review PR quality and accuracy
  • Adjust severity thresholds as needed
  • Provide feedback on fixes
  • Refine automation settings over time

Next Steps

Hybrid Testing

Learn about Pensarā€™s hybrid testing methodology that enables auto-remediation.

Getting Started

Set up your workspace and connect source code to enable auto-remediation.

Authentication

Configure authentication for comprehensive vulnerability testing.

Adding Domains

Add and verify domains for testing against live environments.