{"id":51402494,"url":"https://github.com/amarjaleelbanbhan/veripatch","last_synced_at":"2026-07-04T08:00:56.835Z","repository":{"id":369126066,"uuid":"1288176484","full_name":"amarjaleelbanbhan/VeriPatch","owner":"amarjaleelbanbhan","description":"Verified remediation for npm vulnerabilities — scan, sandbox-verify fixes are safe, and get audit-grade evidence reports.","archived":false,"fork":false,"pushed_at":"2026-07-03T18:11:42.000Z","size":465,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-03T19:16:40.819Z","etag":null,"topics":["cli","cve","devsecops","docker","github-actions","nodejs","npm","sca","security","supply-chain-security","typescript","vulnerability-scanner"],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/amarjaleelbanbhan.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"docs/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":"docs/ROADMAP.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-03T10:45:51.000Z","updated_at":"2026-07-03T18:20:29.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/amarjaleelbanbhan/VeriPatch","commit_stats":null,"previous_names":["amarjaleelbanbhan/veripatch"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/amarjaleelbanbhan/VeriPatch","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amarjaleelbanbhan%2FVeriPatch","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amarjaleelbanbhan%2FVeriPatch/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amarjaleelbanbhan%2FVeriPatch/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amarjaleelbanbhan%2FVeriPatch/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/amarjaleelbanbhan","download_url":"https://codeload.github.com/amarjaleelbanbhan/VeriPatch/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amarjaleelbanbhan%2FVeriPatch/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35114174,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-04T02:00:05.987Z","response_time":113,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","cve","devsecops","docker","github-actions","nodejs","npm","sca","security","supply-chain-security","typescript","vulnerability-scanner"],"created_at":"2026-07-04T08:00:52.748Z","updated_at":"2026-07-04T08:00:56.827Z","avatar_url":"https://github.com/amarjaleelbanbhan.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# VeriPatch\n\n\u003e Verified remediation for npm vulnerabilities — don't just detect, **prove the fix is safe**.\n\n[![CI](https://github.com/amarjaleelbanbhan/VeriPatch/actions/workflows/ci.yml/badge.svg)](https://github.com/amarjaleelbanbhan/VeriPatch/actions/workflows/ci.yml)\n[![npm version](https://img.shields.io/npm/v/veripatch.svg)](https://www.npmjs.com/package/veripatch)\n[![npm downloads](https://img.shields.io/npm/dm/veripatch.svg)](https://www.npmjs.com/package/veripatch)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n\n![veripatch scan finding real axios vulnerabilities, then veripatch verify proving a fix is safe in a Docker sandbox](assets/veripatch-demo.gif)\n\nDetection of vulnerable npm dependencies is commoditized (`npm audit`, Dependabot, Snyk).\n**Verified remediation is not.** Engineers don't apply fixes because of alert fatigue, fear\nof breakage, and lack of evidence. VeriPatch closes the gap:\n\n1. **Scan** — rank vulnerabilities by severity × fix feasibility (via [OSV.dev](https://osv.dev)).\n2. **Verify** — apply the fix in a hardened Docker sandbox, re-scan to prove the vulnerability\n   left the resolved tree, run your build and tests to prove nothing breaks.\n3. **Report** — emit audit-grade evidence reports (Markdown + JSON) with deterministic\n   confidence verdicts.\n\n|                                                     | `npm audit` | Dependabot | Snyk | VeriPatch |\n| --------------------------------------------------- | :---------: | :--------: | :--: | :-------: |\n| Detects known vulnerabilities                       |     ✅      |     ✅     |  ✅  |    ✅     |\n| Ranks by severity                                   |     ✅      |     ✅     |  ✅  |    ✅     |\n| Opens a fix PR                                      |     ❌      |     ✅     |  ✅  | ❌ (yet)  |\n| **Actually runs the fix in isolation**              |     ❌      |     ❌     |  ❌  |    ✅     |\n| **Independently re-scans to prove the CVE is gone** |     ❌      |     ❌     |  ❌  |    ✅     |\n| **Runs your real build/test before you merge**      |     ❌      |     ❌     |  ❌  |    ✅     |\n| Verdict from exit codes only, never heuristics      |     n/a     |    n/a     | n/a  |    ✅     |\n| Free, self-hosted, no account                       |     ✅      |     ✅     |  ❌  |    ✅     |\n\n## Quickstart\n\n```bash\nnpm install -g veripatch\n\nveripatch doctor              # diagnose environment (Node, Docker, lockfile, network)\nveripatch scan                # ranked vulnerability table in \u003c15s\nveripatch verify GHSA-...     # sandboxed proof a fix is safe\nveripatch update GHSA-...     # apply a verified fix to your working tree\nveripatch report GHSA-...     # re-render evidence without re-running anything\n```\n\n`scan` and `report` work everywhere; `verify` requires a reachable Docker daemon.\n\n`scan` understands `package-lock.json` (v2/v3), `yarn.lock` (classic and berry), and\n`pnpm-lock.yaml` (v6/v9), auto-detected. `verify`/`update` currently replay fixes with npm, so\nthey refuse yarn/pnpm projects explicitly rather than corrupting them.\n\n### As a GitHub Action\n\n```yaml\n- uses: actions/checkout@v4\n- uses: amarjaleelbanbhan/VeriPatch@v0.1.0\n  with:\n    severity-threshold: high\n    fail-on: new\n```\n\nSee [examples/workflow.yml](examples/workflow.yml) for the full example (triggers, permissions,\nbaseline mode) and [action.yml](action.yml) for every input.\n\n## How it works\n\n```\nscan  → parse lockfile → OSV advisories → rule engine → ranked, fix-resolved report\nverify → stage a copy → apply the bump → install (sandboxed, scripts off)\n       → re-scan the copy to prove the vuln is gone → build/test (network off)\n       → deterministic verdict from exit codes + the re-scan alone\n```\n\nSee [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for the full data flow and layering.\n\n## Design principles\n\n- **Verification-first** — confidence verdicts derive only from exit codes and VeriPatch's own\n  re-scan, never from log-text heuristics (see [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md)).\n- **Security-first** — untrusted project code only ever executes inside a hardened,\n  network-restricted container. Zero telemetry. No secrets required. See\n  [docs/SECURITY.md](docs/SECURITY.md).\n- **CI-native** — machine-readable `report.json` ([docs/API.md](docs/API.md)), deterministic\n  exit codes, baseline mode so pre-existing debt doesn't fail builds.\n\n## Documentation\n\n|                                                |                                                                      |\n| ---------------------------------------------- | -------------------------------------------------------------------- |\n| [docs/CLI.md](docs/CLI.md)                     | Full command reference, flags, exit codes                            |\n| [docs/CONFIGURATION.md](docs/CONFIGURATION.md) | `.veripatchrc` reference and precedence                              |\n| [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md)   | Layering, data flow, confidence rules                                |\n| [docs/API.md](docs/API.md)                     | `report.json` schema, ports, OSV usage                               |\n| [docs/SECURITY.md](docs/SECURITY.md)           | Threat model, sandbox guarantees, disclosure policy                  |\n| [docs/CONTRIBUTING.md](docs/CONTRIBUTING.md)   | Setup, layering rules, fixture-adding guide                          |\n| [docs/ROADMAP.md](docs/ROADMAP.md)             | What's shipped, what's next                                          |\n| [docs/adr/](docs/adr/)                         | Why OSV over NVD, SQLite over Postgres, Docker over subprocess, etc. |\n\n## Status\n\nAll MVP milestones (scan, verify, report/update/doctor/cache, GitHub Action) are implemented\nand tested. Pre-1.0: the CLI contract and `report.json` schema are considered stable but not\nyet field-proven — see [docs/ROADMAP.md](docs/ROADMAP.md) for what's tracked toward v1.0.\n\n## Contributing\n\nSee [docs/CONTRIBUTING.md](docs/CONTRIBUTING.md). Issues and discussion are welcome.\n\n## License\n\n[Apache-2.0](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Famarjaleelbanbhan%2Fveripatch","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Famarjaleelbanbhan%2Fveripatch","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Famarjaleelbanbhan%2Fveripatch/lists"}