Security Agents
Security Agents scan your codebase for vulnerabilities, misconfigurations, and secrets — and can automatically remediate them. Run on-demand or on a continuous schedule.
Bugbot reviews individual pull requests as they're opened. Security Agents run deep scans across your entire codebase on a schedule. Both are complementary.
What they detect
Hardcoded Secrets
API keys, tokens, passwords, and credentials accidentally committed to your repository.
Vulnerable Dependencies
npm, PyPI, and Maven packages with known CVEs. Includes transitive dependency scanning.
Injection Vulnerabilities
SQL injection, command injection, XSS, and path traversal vulnerabilities in your application code.
Misconfigured Infrastructure
Overly permissive IAM roles, public S3 buckets, open security groups in IaC files (Terraform, CloudFormation).
Setting up
Enable Security Agents
Go to Settings → Cloud Agents → Security and enable security scanning for each repository.
Configure scan schedule
Set a scan frequency:
- On every push to main
- Daily (recommended)
- Weekly
# .vyre/security.yaml
security:
schedule: daily
notify:
slack: "#security-alerts"
email: "security@company.com"Set up notifications
Configure where findings are reported: GitHub Security Advisories, Slack, or a custom webhook.
Automated remediation
Security Agents can automatically fix certain categories of findings:
Dependency updates
When a vulnerable dependency is found, Agent can:
- Update the package to the patched version
- Run your test suite to verify nothing breaks
- Open a PR with the fix titled "security: update [package] to [version]"
Enable in .vyre/security.yaml:
auto_remediate:
vulnerable_dependencies: true
require_tests_pass: trueSecret rotation
When a hardcoded secret is found, Security Agent:
- Opens a high-priority issue flagging the secret
- Does NOT auto-rotate (rotation requires human judgment)
- Provides step-by-step rotation instructions in the issue