Built on Switch · works in Slack, Teams, Discord and Mattermost

Don't patch every alert. Patch the one your code actually calls.

ZeroDay Sentry puts two AI agents in your security channel. One reads your code to check whether a flagged CVE is reachable. The other upgrades the package, fixes what breaks, runs your tests and rescans. A lead developer approves in the thread.

See a real run Clone the repo

Open source. Runs on your machine. Works with the coding agent you already use. Nothing is marked ready for review until a human says yes.

#security-war-room acme/checkout-web

Dependabot bot 10:42

2 new alerts on acme/checkout-web

• axios 0.27.2 CVE-2023-45857 Medium (6.5)
• lodash 4.17.20 CVE-2021-23337 High (7.2)

Meera 10:42

@cve-analyst are these real for us?

@cve-analyst Agent 10:43

NOT REACHABLE lodash: The flaw is in _.template. lodash is imported in 6 files and we use debounce, get and isEqual.

REACHABLE axios at src/api/client.js:42 creates the shared instance with withCredentials: true, attaches token to cross-origin request.

Demo repo and sample data. The CVEs are real.

The problem

Scanners match version numbers, not call paths. That is why most alerts are noise and a few are real.

Alerts say "vulnerable", not "used".

A flagged package may never call the broken function. In Sentry's demo repo, 2 alerts arrive and only 1 is reachable.

Upgrades break things.

Moving axios from 0.27 to 1.x makes a CommonJS Jest setup fail with "Cannot use import statement outside a module", because 1.x ships ES modules.

So alerts wait. Nobody reads this

The one real alert sits in the same list as the noise, and nobody owns checking it.

Sentry answers two questions in the channel where the team already talks: do we call it, and can we upgrade without breaking anything?

Bring the agents you already use. Clone the repo and run your first alert in about ten minutes.

Clone the repo