Don't just flag it, fix it: How to run CodeMender in your pull requests

Google’s CodeMender integrates automated security fixes into pull requests, allowing developers to address software flaws without leaving the review timeline. Findings appear as a table with IDs, and slash commands like /verify and /fix trigger sandboxed exploit simulations or patch generation directly in the thread. The system avoids external consoles or consoles, keeping the process contained within GitHub’s interface.

CodeMender’s /verify command runs exploit simulations in an ephemeral sandbox, returning a trace of the attempt to assess vulnerability severity. Results are streamed to Cloud Storage for audit trails, while the pipeline flags inconclusive outcomes to prevent false negatives. The agent’s confidence scoring helps prioritize high-risk findings for immediate review.

When a vulnerability is confirmed, the /fix command generates a code diff with proposed patches, which reviewers can preview before approving. A single /approve reply commits the patch to the branch, pushes it, and updates the security gate status to green, enabling branch protection to enforce the merge block.

Security relies on short-lived OIDC tokens via GitHub Actions and Cloud Run’s sandboxed microVM execution environment. Google recommends mapping immutable repository IDs for token validation, ensuring no long-lived credentials are exposed. Cloud Run’s second-generation execution environment restricts the agent’s reach, preventing unauthorized network access during exploit simulations.