FixAlert

Know the moment your site’s code becomes unsafe.

FixAlert watches the packages your site is built on. When one gets a security problem, you get one alert with the fix ready to paste into your coding agent.

See an example

Read-only access. JavaScript, Python, PHP and Ruby.

acme/shop

4 critical
  • next 15.1.0 · 34 problems, 4 critical
Fix security problems in the dependencies of acme/shop.

1. next 15.1.0 (direct dependency, package-lock.json)
   - GHSA-2xp9-vwfh-vxw4 (critical): Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used
   - GHSA-9qr9-h5gf-34mp (critical): Next.js is vulnerable to RCE in React flight protocol
   - GHSA-f82v-jwr5-mffw (critical): Authorization Bypass in Next.js Middleware
   - and 31 more. The audit command below lists them all.
   Fix: upgrade next to the newest 15.x release, at least 15.5.27.

Then:
1. Run `npm install` (package-lock.json) so the lockfile and installed packages update.
2. To confirm, run `npm audit` and confirm the IDs above are no longer reported.
3. Run the build and the tests. Fix anything the upgrade breaks.
4. Do not change unrelated packages.
5. Commit and push to main. FixAlert checks the push and closes these alerts.

An example alert, with real advisories for next 15.1.0.

Set up once. Hear from it only when it matters.

  1. 01

    Sign in with GitHub

    Your account is made in the same step. FixAlert only reads your code.

  2. 02

    Pick the repos to watch

    Turn on the ones your sites are built from. They are checked right away.

  3. 03

    Paste the fix when an alert comes

    One email per real problem. Your next push closes it.