CASE STUDY
AI-Powered Vulnerability Remediation
An automated pipeline that detects open vulnerability tickets, analyzes the affected codebase, and generates fix pull requests — keeping remediation ahead of strict SLAs without pulling engineers off product work.
THE PROBLEM
Wellthy's security program holds critical and high-severity vulnerabilities to a 0-day mean time to remediation — findings are patched the day they surface. On a healthcare platform handling sensitive caregiver data, that bar is non-negotiable.
But as the automated vulnerability pipeline matured, detection outpaced human capacity. Every finding pushed to the centralized ticketing system needed an engineer to read it, find the affected code, write a patch, and shepherd it through review — across 7+ engineering teams with their own roadmaps. The bottleneck wasn't finding vulnerabilities. It was fixing them.
THE SYSTEM
Detection to pull request, end to end.
HOW IT WORKS
Scheduled detection
A CircleCI cron pipeline runs on a schedule and scans the vulnerability ticket queue for open remediation work, so no human has to remember to kick anything off.
Codebase analysis
For each ticket, the system pulls the affected repository and assembles context: the vulnerable dependency or code path, surrounding code, and the project's conventions.
Fix generation
Claude analyzes the vulnerability alongside that context and generates a candidate fix scoped to the actual finding.
Pull request
The pipeline opens a pull request with the generated patch, linked back to the originating ticket for SLA tracking.
Human review
An engineer reviews, validates, and merges. The system accelerates remediation; accountability stays with people.
OUTCOMES
The system runs as part of the security program that maintained a 0-day mean time to remediation for all critical and high-severity vulnerabilities, with full security coverage across 7+ engineering teams — without growing the security team.
MTTR maintained
Teams covered