Security findings, fixed.
Send us what your scanner, pentest or customer found. Get back pull requests that fix it, checked before you see them, with the evidence to prove it. In one week.
NDA before access · Your code stays in your GitHub · Pull requests, never pushes
- Rescan: finding gone, no new findings
- Change stays on the reported line
- Running the fix again changes nothing
fix types automated
languages fixed by the engine
week for a Fix Sprint
commits pushed to your branches
Fixes findings from
The problem
Scanners find the problems. Someone still has to fix them.
A review is coming
A SOC 2, ISO 27001 or customer review is on the calendar, and the open findings are not cleared.
A pentest report landed
A PDF of findings that nobody has time to turn into pull requests.
A deal needs proof
A customer's security questionnaire asks whether known issues are fixed, and by when.
The backlog never shrinks
Hundreds of open scanner alerts, and every sprint something more urgent comes first.
How a Fix Sprint works
From a list of findings to merged fixes.
01
Send us your findings.
From Snyk, Semgrep, CodeQL or GitHub code scanning, a pentest report, a customer's security questionnaire, or any list of findings. We sign your NDA first.
Findings received
ERRORSQL injection
app/users.py:6
ERRORInsecure randomness
app/users.py:7
ERRORMissing timeout
app/users.py:8
02
We fix them as pull requests.
Railo writes the fixes it knows. We write the rest. Every fix, whoever wrote it, passes the same checks before it reaches you.
Pull requests opened for you
MergedFix SQL injection in users.py
rescan clean · #142
MergedUse a secure random source in users.py
rescan clean · #143
In reviewAdd a request timeout in users.py
rescan clean · #144
03
You merge. You get the proof.
Your team reviews and merges, with your CI running as usual. You receive a report of each finding, its fix, how it was checked and when it was merged.
Evidence pack · acme/api4 of 4 findingsFinding Location Status Note SQL injection CWE-89 app/orders.py:6 Merged Rescan clean Command injection CWE-78 jobs/export.py:21 Merged Rescan clean Hardcoded secret CWE-798 config/settings.py:12 Merged Key to rotate XML external entities CWE-611 feeds/parse.py:4 In review Adds defusedxml Example, not customer data
Real output
This is what lands on your pull request.
Each fix arrives as a suggestion on the exact line, after Railo has rescanned it. Your reviewer reads it, then commits it with one click, or doesn't.
- Rescanned before you see it
- Nothing committed to your branch
- The same engine runs every Fix Sprint
SQL injection (CWE-89), line 6. Rescanned after the fix: the finding is gone and nothing new appeared.
Railo proposes this fix. Review it, then use Commit suggestion to apply it.
Railo v2.5.2's comment format, with the fixes it made on a test pull request of ours in October 2026. The GitHub frame is redrawn; the vulnerable code is from Railo's fix-quality benchmark.
What we fix
Automated where it's measured. By hand where it isn't.
fix types automated, 5 languages
Each ships only after passing a 90% bar on reviewed examples, and must leave safe code untouched.
- SQL injection
- Command injection
- Cross-site scripting
- Path traversal
- Hardcoded secrets
- XML external entities
- Missing request timeouts
- Insecure randomness
- Insecure cookies
- SQL injection in Django and SQLAlchemy raw queries
- Server-side template injection
- Open redirects
- Disabled CSRF protection
- Permissive CORS with credentials
- Disabled TLS certificate checks
- Unsafe YAML loading
- eval() on data
- XML entity expansion
- Stack traces sent to users
- Debug mode left on
Everything else, by hand.
Ruby and C#, and anything the engine doesn't cover. Same checks on every change.
Pull requests, never pushes.
Nothing lands on a branch you own until a person on your team merges it.
The same finding, the same fix.
Fixes are deterministic rewrites, not generated text. A result can be reproduced and audited.
Honest about limits.
A finding we can't fix safely comes back explained, with the change we recommend.
Why Railo
Not another scanner. The part that comes after it.
| Capability | A scanner alone | Fixing it in-house | Railo Fix Sprint |
|---|---|---|---|
| Finds the issues | Uses your scanner | Uses your scanner, pentest or questionnaire | |
| Writes the fixes | Your engineers | ||
| Each fix rescanned before review | If someone does it | ||
| Arrives as reviewable pull requests | |||
| Evidence pack for an auditor or customer | Assembled by hand | ||
| Cost | Your licence | Roadmap time | Fixed price, from $1,500 |
Your code
Built to be let into your repo.
NDA before access
We sign yours before we see any code.
Least access
Read the repositories in scope and open pull requests. Nothing else.
You merge
Nothing lands on a branch you own until your team approves it.
No guessing
Automated fixes are fixed rules, not a language model. The same finding gets the same fix.
Pricing
Pay for fixed findings, not for alerts.
GitHub Action
Free
One workflow file. Railo suggests fixes on your pull requests, in your own CI.
- One-click suggestions on the PR
- Or a separate fix PR per pull request
- Runs on your runner; no code leaves it
Fix Sprint
Start here$1,500fixed price
Up to 25 findings in one repository, fixed and evidenced in one week.
- Every finding fixed or explained
- Each fix checked and reviewable
- Evidence pack for your auditor or customer
- NDA before we start
Pentest close-out
From$4,000per report
Every finding in one pentest report, across up to 25 repositories, closed inside your retest window.
- One pull request per weakness, in every repository
- Evidence pack under your report's own finding IDs
- Retest promise on every in-scope finding
- $4,000 to $6,000, quoted after we read the report
Fix Desk
From$1,500a month
New findings fixed every month, so the count stays at zero. Month to month, no long-term commitment.
- Fixes delivered each week
- Monthly evidence report
- Priority on audit deadlines
- Overflow at a stated hourly rate
Prices in US dollars, fixed before work starts, and every engagement starts with an NDA. A sprint covers one repository and up to 25 findings; a Dependabot, Snyk or npm audit backlog cleared with CI green is a sprint by another name (we call it a Dependency Sprint; same price, same evidence pack). More than one repository, or a larger report? We quote it in writing. Ask us. See what a sprint ends with: a sample evidence pack.
Retest promise. If your tester's retest still finds an in-scope finding we marked fixed, we fix it again at no charge, until the retest passes it or we explain why a code change would be wrong. We do not promise what a retest will find elsewhere.
Not included: infrastructure and cloud settings, architecture changes, decisions about who may see what, findings outside the agreed list, testing of any kind, merging on your behalf, and any promise that the whole application is secure.
From the founders
Why we built Railo.
Security tools have become very good at finding problems. Fixing them has not kept up.
Most engineering teams carry a backlog of known findings that never clears, because every fix has to be written, reviewed and tested by the same people who are shipping the product. The backlog only moves when an audit or a customer's security review forces it to.
Railo exists to close that gap. We fix findings rather than report them, and we hold every fix to the standard a security reviewer expects: the same finding gets the same change, every fix is rescanned before anyone sees it, and each one arrives as a pull request with a record behind it.
We chose not to let AI write fixes. Each fix type is a rule we wrote and measured, and it ships only after passing 90% of reviewed examples. Findings that need judgement are fixed by us, under the same checks. Every Fix Sprint is run by the founders, so you always know who touched your code and why.
Zarif Latif
Founder & CEO
Kazi Tasfin Mahmud
Co-founder & CSO
Questions
Before you send us a list.
Audit coming up? Read overdue vulnerabilities in Drata or Vanta and remediation evidence for SOC 2.
Something not covered? zarif.latif@railo.dev
What access do you need?
Access to the repository through GitHub, scoped to what the work needs. We open pull requests and never push to your branches. We work in a private clone used only for your sprint and delete it when the sprint ends.
Which languages do you cover?
Railo fixes common issues in Python, JavaScript & TypeScript, Java, Go and PHP automatically today. We fix the rest by hand, including Ruby and C#, with the same checks on every fix.
What if a finding can't be fixed safely?
Then we don't pretend. You get the finding back with an explanation and the change we recommend, so a person on your team can decide.
Do you run our tests?
Your CI runs on every fix pull request, as it would for any change. We can also run your test suite before delivering a fix, and drop any fix that adds a failure.
How is the free Action different from a Fix Sprint?
The Action runs in your CI and suggests fixes on new pull requests, for the fix types Railo automates. A Fix Sprint clears the findings you already have, in any of the languages above, with the work the engine can't do done by hand and an evidence pack at the end.
Is the evidence pack a compliance certificate?
No. It is a record of what was found, what changed, how each change was checked and when it was merged. Your auditor decides what it counts towards.
Clear the backlog. This week.
Tell us what your scanner, pentest or customer found, and we'll scope the sprint with you.