Remediate a vulnerability

Goal: choose the next dependency fix, make the change in your own workflow, and verify it with a new scan, without confusing a hidden alert with a fix.

Verified on October 28, 2026 against the code. Prerequisites: a completed scan, a finding to examine and, for local decisions, a member or administrator role. Guide home.

Perpensa ranks the work; it does not open pull requests, push commits or apply version changes. You change the dependency in your repository, through your coding agent, Renovate, Dependabot or by hand, then rescan.

1. Pick the next item

Open Update queue or Findings and choose the application and environment. Production is selected by default. Rows are ordered by Rank within Fix now, Plan and Monitor; these categories come from rules. On Pro and Team, a Perpensa Rank badge marks an order refined by Perpensa AI (tooltip: Ranked by Perpensa AI). It refines the order inside a category; it never moves an item to another category and does not prove the priority is correct. See Understand results.

2. Examine the finding

Open the finding. Check the package, observed version, reference, commit, file and result date. Read Why rank and Signals, and the indicator limitations. Confirm that the scanned reference matches the code you want to fix.

Fix shows the target version. No fix yet means no usable fixed version is known: consult the advisory and project releases, wait for a release, or apply a mitigation assessed by your team.

Use Open update to see the update that addresses this finding. One update can address several findings. The update details show the current and target versions, Breaking when the jump is incompatible, Advisories, Found in and, when available, a command you can copy. Check that command against your environment before running it.

3. Hand the fix to your coding agent

Copy prompt for your coding agent, on finding and update details, copies a remediation prompt to the clipboard. Each row of the Findings table also has a Copy prompt button and a Copy prompt entry in its actions menu. The row button copies without opening the row.

The prompt describes the repository, ecosystem, files, package, advisory, severity and target version, with upgrade and verification steps. It flags a breaking upgrade instead of asking for it blindly. For an accepted risk or a watched product, it asks to check the decision or the deployed product version instead of changing dependencies.

Paste the prompt into your coding agent, then review its change, run your tests and merge through your usual process. If copying is unavailable, open the collapsed Show prompt section below the button and select the prompt; in finding and update details it opens by itself after a failed copy. On Pro and Team, your agent can also query Perpensa directly through MCP.

4. Watched public products

For a repository tracked as a Public watch, the update concerns an upstream product. View product remediation groups the dependencies fixed by a product version. Evaluate and deploy that version in your own environment, then adjust the tracked reference with Change pin and check the new scan. Changing the pin deploys nothing and may temporarily differ from your installed version.

5. Accept a risk instead of fixing it

Accept risk is a local, audited decision for one finding in one application environment. It excludes that occurrence from the local posture; it does not fix the software. Select Accepted risks to review decisions and use Restore to reopen one. Monitor is an automatic recommendation, not an acceptance. Manage applications explains the effects on posture.

6. Verify after the change

After merging and deploying, open the application environment and use Scan source on the relevant reference. Wait for the completed result, then check:

1. Scan date, success and relevant coverage.
2. The new version in Inventory, at the expected commit and file.
3. Findings still associated with that version.
4. Actual deployment of that version in your environments, outside Perpensa.

A row disappearing is not, on its own, proof of a fix: check the scanned reference and the inventoried version. To follow a different branch or tag, remove that environment’s association and attach the new exact reference.

Troubleshoot the workflow

Problem	Next action
No fix yet	Examine the advisory and release branches; consider a mitigation
Finding still visible after merge	Check the scanned reference, inventoried version and that the new scan completed
Copy prompt does nothing	The browser blocked the clipboard; open Show prompt and select the prompt
Public watch with no code change	Use View product remediation; connect your fork as your own repository to edit

A fix is verified when you have the change, appropriate tests, an updated inventory and deployment where required. Return to the user guide.