OpenSRE can turn one GitHub security or quality finding into a local fix and,
when approved, a pull request. It supports Dependabot alerts, code-scanning/
CodeQL alerts, and GitHub Code Quality standard findings.
This is mutating. OpenSRE asks before editing files, then asks again before
committing, pushing, and opening a PR.
Set it up
OpenSRE has built-in local fixers for some Code Quality findings, such as
unused imports and unused local variables. For findings that need broader code
reasoning, it automatically uses the first coding agent CLI it finds installed
and logged in: Pi, Claude Code, or Codex. No configuration is needed when one
of those CLIs already works on your machine.
To pin a specific agent instead of auto-detection:
Required access
Use it
In the interactive shell:
For a broad repo request, OpenSRE selects one open supported finding by severity.
If you do not name a repo, it uses the current checkout’s GitHub origin.
For a specific alert, include the alert URL or say the alert type and number:
OpenSRE asks before editing files, then asks again before committing, pushing,
and opening the PR.
What happens
- OpenSRE reads the GitHub alert or Code Quality finding details.
- It verifies the local checkout’s
origin matches the finding repository.
- OpenSRE first tries a built-in local fixer when one safely applies.
- If no built-in fixer applies, OpenSRE runs the auto-detected (or pinned)
coding agent CLI to implement the fix in the local checkout.
- If PR shipping is requested and approved, OpenSRE commits only the files the
fix run changed, pushes an
opensre/github-security-fix-* branch, and opens
a PR into the default branch.
Secret-scanning alerts are not auto-fixed. Revoke or rotate the secret first,
then plan repository cleanup separately. 
