Remediation

Open a finding's fix as a GitHub pull request or GitLab merge request, file it in Jira or Linear, or hand it to a coding agent.

Rokkhe proposes fixes; your team reviews and merges them. From a finding you can open a fix request against the repository or file an issue in your tracker. Rokkhe does not merge anything, and a merged fix is verified by a retest rather than assumed: see /docs/retests.

#Fix pull requests and merge requests

When a finding carries a code fix (the exact code before and after) and a file location, the finding page can open it as a change request.

• The change is one commit to one file, on a deterministic branch named `rokkhe/fix-…`. Asking again reuses that branch or the open request instead of opening a duplicate.
• If the file no longer contains the code the finding pointed at, the request fails rather than guessing where the fix goes.
• The pull request is titled `Rokkhe fix: <finding title>`. Its description carries the severity, CVSS score, CWE, description and remediation, and asks for careful review before merging.
• Each request runs as a durable job with bounded retries, and the request is written to the audit trail.

#Tracker issues

A finding can become a Jira Cloud or Linear issue in the project or team chosen on the Integrations page. Each issue carries a rokkhe-<ref> marker, so a retry finds the issue it already created instead of filing a second one.

#Who can open them

Fix requests and issues need the remediation permission, held by Owner, Admin, Security lead and Analyst. Viewers read the linked records but cannot create them. Connecting GitHub, GitLab, Jira or Linear is an Owner or Admin task. Both features need a deployment in database mode.

#Hand a finding to a coding agent

bashrokkhe fix <run> <finding-id>

rokkhe fix writes a brief from the finding and launches a local coding agent on it: the claude or codex CLI, whichever is installed first, or the one named with --with. It asks before launching, because the agent gets write access to your working copy, and outside a terminal it refuses without --yes. --print writes the brief and prints its path without launching anything.

#API