Fix code vulnerabilities and manage diffs

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms, and the Additional Terms for Generative AI Preview Products. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

CodeMender can automatically produce, validate, and apply source code patches for verified vulnerabilities, testing them in your local sandbox to prevent regressions.

Generate vulnerability fixes

Use cm fix to generate a validated security patch for a verified finding::

cm fix FINDING_ID

When you run cm fix, CodeMender performs the following validation steps:

1. Generates a patch candidate using the cloud-hosted reasoning engine.
2. Applies the patch to a copy of the source code inside your local sandbox.
3. Compiles and tests the codebase by running your configured build.command to ensure the project builds and unit tests pass.
4. Re-runs the verified PoC exploit to confirm that the vulnerability is no longer exploitable.

By default, CodeMender will prompt you to confirm each file modification before writing it to disk in your workspace. Once all checks pass, the verified patch is applied to your workspace and is ready to be staged.

Fix flags

• Provide fix context (-c / --context): Provide architectural constraints or coding guidelines:

  cm fix FINDING_ID -c "Use the safe parameterized database helper in src/db/query.go"

• Auto-approve writes (-y / --yes): Auto-approve all file writes and prompts during the fix process:

  cm fix FINDING_ID -y

  Note: You can also disable interactive write prompts globally by setting confirm_writes: false in your config.yaml.
• Bypass cache (--no-cache): Force CodeMender to generate a fresh patch:

  cm fix FINDING_ID --no-cache

Inspect and manage local VCS diffs

CodeMender includes built-in VCS commands to help you inspect, stage, and manage code changes introduced by patches before committing them:

• View repository status: Check which files have been modified or created by CodeMender in your local workspace.

  cm vcs status

• Inspect diffs: Review line-by-line unified diffs of all uncommitted code modifications generated by the agent.

  cm vcs diff

• Stage changes: Add verified patch modifications to your local staging environment so they are ready for commit.

  cm vcs stage

• Revert session modifications: Discard all local file modifications generated during the current session and restore your repository to its baseline state.

  cm vcs reset