Railo

Railo is a GitHub App that finds vulnerabilities in pull requests and opens companion fix pull requests with verification evidence attached. It installs directly through the GitHub Marketplace with no CI configuration required, and runs automatically on every pull request across supported repositories.

What It Is

Railo is a GitHub-native application focused on security remediation — not just detection. It scans changed code on each pull request for vulnerabilities such as SSRF, SQL injection, and path traversal, traces source-to-sink paths, and then produces deterministic fix PRs that developers review and merge through their normal workflow. The tool is designed to clear security backlogs without requiring engineers to hand-triage every finding.

How the Verification Layer Works

A core differentiator Railo emphasizes is its verification step, which runs on every proposed fix before it is surfaced. Each fix PR carries one of four explicit outcomes:

• Cleared — the targeted vulnerability path was eliminated under the modeled assumptions.
• Not cleared — the check did not hold; the fix is not presented as resolved.
• Inconclusive — evidence was not strong enough to decide either way.
• Not attempted — no verification was run for this finding.

When evidence is only heuristic, Railo downgrades the fix to manual review rather than auto-merging. The tool also claims deterministic output: the same input produces a byte-identical patch, reproducible from its pinned commit.

GitHub-Native Workflow

Railo operates entirely through the GitHub pull request model. It does not commit to existing branches; every proposed change arrives as its own pull request, keeping the diff, review, and merge decision in the developer's hands. Setup involves installing the GitHub App — no agents to run, no CI config to write. On each PR, Railo posts findings as comments and a status check, each carrying evidence and stated limitations.

Detection Coverage and Data Handling

Railo supports vulnerability detection across 7 languages for free. The homepage states 68% SSRF clearance (248 of 363 CWE-918 findings) across 22 repositories, measured across 21,768 findings — a vendor-published figure. Pull-request content is processed only for the lifetime of a scan and is not retained afterward. Run metadata such as timestamps, vulnerability types, and fix PR numbers is kept for up to 90 days to power the dashboard.

Enterprise and Closure Sprint

Beyond the self-serve tiers, Railo offers an enterprise option with unlimited repositories, evidence export, and an audit log. It also offers a "Finding Closure Sprint" — a fixed-scope engagement targeting one authorized Python repository, delivered within five business days with reviewed fix PRs and one follow-up scan.