LegacyFixer

Automated Python dependency security, without PR noise

LegacyFixer scans selected Python repositories, records dependency-security results, and creates review-ready pull requests only when repository settings explicitly allow it.

Start free trial See demo scan

Passive by default

Start with scan results only. No code changes are made during the recommended first onboarding run.

Review-ready PRs

When enabled, fixes are proposed through isolated branches and pull requests for human review.

Repository-level control

Each repository controls whether PR creation is enabled and how many LegacyFixer PRs can be open.

Start free trial

LegacyFixer is available as a self-service GitHub App for selected Python repositories. Start with GitHub, connect repositories, and run passive dependency-security scans during a 7-day trial.

Start with Sign in with GitHub. During trial, you can connect up to 3 repositories. Passive scans are available first; pull requests are created only when repository settings explicitly allow them.

  1. Sign in with GitHubCreate your workspace and connect selected Python repositories.
  2. Run passive scans firstThe first scan records findings without opening a pull request.
  3. Enable PRs deliberatelyPull request creation is optional and controlled per repository.

Current validated coverage

Dependency layouts

  • requirements.txt
  • nested requirements.txt
  • poetry.lock
  • Pipfile.lock
  • setup.cfg install_requires

Behavioral cases

  • passive findings
  • dependency conflict
  • dependency hell
  • PR diff granularity
  • no PR in passive mode

Best first fit: a small or medium public repository that is not production-sensitive.

Review the public demo

Review a real passive LegacyFixer scan before connecting a repository. The demo shows the recommended first onboarding path: scan, record findings, and avoid pull request creation until the result is reviewed.

Open read-only passive status page Successful scan with findings and no PR opened

Demo scan snapshot

Trigger
webhook
Status
success
Result
NO_ACTION
Reason
passive_findings
PR opened
no
Run time
21s