FixAlert

Your site’s security, one paste away.

FixAlert watches the packages your site is built on. When one gets a security problem, you get one alert with the fix ready for your coding agent.

Read-only access. JavaScript, Python, PHP and Ruby.

FixAlertnow

Security update needed in acme/shop

next 15.1.0 · 4 critical. The fix is ready to paste.

From alert to fixed, without learning security.

Four steps, and you only do two of them.

  1. 1

    An alert arrives.

    Only when a package your site uses gets a real security problem. One email, never a repeat.

    FixAlertnow

    Security update needed in acme/shop

    next 15.1.0 · 4 critical. The fix is ready to paste.

  2. 2

    Paste the prompt.

    Into Claude Code, Cursor or Codex. It says exactly what to upgrade and how to check it.

    coding agent — acme/shop

    > Fix security problems in the dependencies of acme/shop.

    1. next 15.1.0 → 15.5.27, the lowest safe version

    ✓ Updated next to 15.5.27

    ✓ npm audit: no known problems

    ✓ Committed and pushed to main

  3. 3

    Push the fix.

    FixAlert checks the push right away.

    $ git push origin main

    → FixAlert is checking acme/shop…

  4. 4

    Fixed. Quietly.

    The alert closes itself. Nothing else to do.

    acme/shop is fixed

    Closed by commit a3f9c1e

Every alert comes with its fix.

A real alert, with the real security problems of next 15.1.0.

shop

acme

Urgent

Someone could run code on your server through image optimization, or get past your login and access checks.

Updates next.

Fix security problems in the dependencies of acme/shop.

1. next 15.1.0 (direct dependency, package-lock.json)
   - GHSA-2xp9-vwfh-vxw4 (critical): Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
   - GHSA-9qr9-h5gf-34mp (critical): Next.js is vulnerable to RCE in React flight protocol
   - GHSA-f82v-jwr5-mffw (critical): Authorization Bypass in Next.js Middleware
   - and 31 more. The audit command below lists them all.
   Fix: move next to 15.5.27, the lowest safe version. Do not upgrade it further.
   Run `npm install next@15.5.27`.

Then:
1. Run `npm install` (package-lock.json) so the lockfile and installed packages update.
2. To confirm, run `npm audit` and confirm the IDs above are no longer reported.
3. Run the build and the tests. Fix anything the upgrade breaks.
4. Do not change unrelated packages.
5. Commit and push to main. FixAlert checks the push and closes these alerts.

Questions

What does FixAlert do?
FixAlert watches the packages your website’s code uses in your GitHub repos. When one of them gets a known security problem or malware, it emails you once, with a prompt to paste into your coding agent, such as Claude Code, Cursor or Codex. When you push the fix, FixAlert checks it and closes the alert.
Which projects does it work with?
JavaScript (npm, pnpm, Yarn and Bun), Python (uv, Poetry, Pipenv and pinned requirements files), PHP (Composer) and Ruby (Bundler) projects on GitHub.
What access does it need?
Read-only access to the code of the repos you choose, through the FixAlert GitHub App. It never changes your code.
How often does it check?
Right after you turn a repo on, on every push to its default branch, and every six hours.
Will it flood my inbox?
No. You get one email per problem, never a repeat. FixAlert emails about serious problems in the packages your project lists itself, and about malware or critical problems anywhere. Smaller problems only show on your dashboard.
Do I need to know about security?
No. Each alert says in plain words what is affected and how urgent it is. The prompt tells your coding agent exactly what to upgrade.

Set it up once. Hear from it only when it matters.

Read-only access to the repos you choose.