# Railo

> GitHub-native security remediation tool that scans pull requests for vulnerabilities and automatically opens verified fix PRs with evidence and explicit limitations.

Railo is a GitHub App that finds vulnerabilities in pull requests and opens companion fix pull requests with verification evidence attached. It installs directly through the GitHub Marketplace with no CI configuration required, and runs automatically on every pull request across supported repositories.

## What It Is

Railo is a GitHub-native application focused on security remediation — not just detection. It scans changed code on each pull request for vulnerabilities such as SSRF, SQL injection, and path traversal, traces source-to-sink paths, and then produces deterministic fix PRs that developers review and merge through their normal workflow. The tool is designed to clear security backlogs without requiring engineers to hand-triage every finding.

## How the Verification Layer Works

A core differentiator Railo emphasizes is its verification step, which runs on every proposed fix before it is surfaced. Each fix PR carries one of four explicit outcomes:

- **Cleared** — the targeted vulnerability path was eliminated under the modeled assumptions.
- **Not cleared** — the check did not hold; the fix is not presented as resolved.
- **Inconclusive** — evidence was not strong enough to decide either way.
- **Not attempted** — no verification was run for this finding.

When evidence is only heuristic, Railo downgrades the fix to manual review rather than auto-merging. The tool also claims deterministic output: the same input produces a byte-identical patch, reproducible from its pinned commit.

## GitHub-Native Workflow

Railo operates entirely through the GitHub pull request model. It does not commit to existing branches; every proposed change arrives as its own pull request, keeping the diff, review, and merge decision in the developer's hands. Setup involves installing the GitHub App — no agents to run, no CI config to write. On each PR, Railo posts findings as comments and a status check, each carrying evidence and stated limitations.

## Detection Coverage and Data Handling

Railo supports vulnerability detection across 7 languages for free. The homepage states 68% SSRF clearance (248 of 363 CWE-918 findings) across 22 repositories, measured across 21,768 findings — a vendor-published figure. Pull-request content is processed only for the lifetime of a scan and is not retained afterward. Run metadata such as timestamps, vulnerability types, and fix PR numbers is kept for up to 90 days to power the dashboard.

## Enterprise and Closure Sprint

Beyond the self-serve tiers, Railo offers an enterprise option with unlimited repositories, evidence export, and an audit log. It also offers a "Finding Closure Sprint" — a fixed-scope engagement targeting one authorized Python repository, delivered within five business days with reviewed fix PRs and one follow-up scan.

## Features
- Automated vulnerability detection on every pull request
- Deterministic fix pull requests with verification evidence
- Source-to-sink path tracing for SSRF, SQL injection, path traversal, and more
- Verification outcomes: cleared, not cleared, inconclusive, not attempted
- GitHub App installation — no CI config required
- Warn-mode PR comments with findings, evidence, and limitations
- Organization-wide policy controls
- Dashboard with run metadata
- Evidence export and audit log (Enterprise)
- Detection across 7 languages
- Pull-request content not retained after scan
- Finding Closure Sprint for Python repositories

## Integrations
GitHub, GitHub Marketplace

## Platforms
WEB, API, BROWSER_EXTENSION

## Pricing
Freemium — Free tier available with paid upgrades

## Links
- Website: https://www.railo.dev
- Documentation: https://www.railo.dev/docs
- Repository: https://github.com/marketplace/railo-dev
- EveryDev.ai: https://www.everydev.ai/tools/railo