Security & Compliance
Vulnerabilities found, fixed, and waiting for your review.
Security & Compliance reads the findings your cloud already reports, files a Linear ticket for each one, and has an AI agent write the fix as a pull request. Read-only on your cloud. Nothing merges without a person.
FOUND
24 findings from Amazon Inspector
6 high · 11 medium · 7 low · synced 4 min ago
FIXED
Writing the fix for CVE-2023-44487
Claude Fable 5.1 · pull request opens when ready
WAITING FOR YOU
#318 waiting for your review
Merge or close · nothing merges without you
Organizations our products and expertise have added value to
How it works
From finding to merged fix, in four steps you can watch.
The agent never touches your cloud. It reads, tickets, writes and waits.
Your cloud
read-only
Security & Compliance
ticket per CVE
Tickets
one PR at a time
Pull requests
you approve
Reviewer
#1
Read the findings
On AWS, findings come straight from Amazon Inspector through a read-only role. On Railway, which has no scanner, the app scans each service’s image itself.
24 findings
#2
File a ticket for each one
Every vulnerability becomes a Linear ticket in the project you choose, highest severity first. Tickets are free, always.
SEC-142 in Linear
#3
Write the fix
The AI model you picked writes the patch and opens a pull request (or merge request on GitLab) on the repo that builds that image. One at a time by default.
PR #318 opened
#4
You review and merge
The agent waits until the pull request is merged or closed before it opens the next. Checks failed? It says so on the row and stops.
Approved · merged
Who it is for
Platform teams on AWS
ECS, EKS or plain EC2 with Amazon Inspector already on. You see the findings; you do not have the hours to patch them.
Startups on Railway
Services deployed from GitHub or a Dockerfile. No scanner, no security hire, a backlog that grows with every base image.
Teams preparing for an audit
SOC 2, HIPAA or GDPR asks how you find and fix vulnerabilities. A ticket and a merged pull request per CVE is the evidence.
Inside the app
Everything you need to run it is on one screen.
01
One table, every finding
Open vulnerabilities by severity, the ticket, the pull request and its status: queued, agent writing, in review, merged, checks failed or needs a repo. Filter by severity or image, search by CVE or package.
02
Set up in about three minutes
Four connections and you are done: where your services run, Linear, GitHub or GitLab, then the model and pace. Each step saves as you go. Quit halfway and you come back to where you left.
03
Read-only on your cloud
AWS connects through a prefilled CloudFormation stack that creates a read-only role; you tick one box. Railway takes a read-only project token, pasted once. The app can read findings and images. It cannot change your infrastructure.
04
You set the pace
How many pull requests open at once (default one), how many fixes go in each, and a monthly spending cap with alerts at 50% and 75%. Findings and tickets keep flowing when fixes pause.
05
Pick the model, pay per fix
Choose from Claude, OpenAI and open models; admins set it once for the workspace. A fix is charged when its pull request opens. Findings, syncs and tickets never cost anything.
Works with the tools you already run.
Both AWS and Railway can be connected to one workspace. The second one is added in Settings after setup.
Guardrails
Built so you can leave it running.
Nothing merges without a person
The agent opens pull requests. Your team reviews and merges them.
Read-only by design
A read-only AWS role or a read-only Railway token. No write access to your cloud, ever.
One pull request at a time
The default pace. The agent waits for a merge or close before starting the next.
Admins decide the model
The AI model and pace are workspace settings only admins can change. A change applies to the next pull request, never one already open.
A cap you set
A monthly spending cap with alerts at 50% and 75%. At 100% new fixes pause; findings and tickets keep flowing.
Leave without a mess
Disconnect everything stops syncing. Open tickets and pull requests stay where they are.
Beyond patching
A container is only as safe as the layers under it.
Auto-patching fixes what the scanner finds. Getting there means a registry that rejects mutable tags, signed images, a base image you chose on purpose, workloads that run without secrets baked in, and runtime detection with evidence you can hand to an auditor. That is the work we do with your team.
Supply chain
Private registry, tag immutability, image signing and scanning before anything deploys.
Base images
Minimal, maintained images; SBOM and provenance; non-root; pinned by digest.
Workloads
Task and execution roles split, secrets from a secrets manager, Pod Identity, network policies.
Detection and evidence
GuardDuty runtime monitoring, Security Hub, CloudTrail: one place for findings and the audit trail.
Registry
ECR · Signer · Inspector
Image
base image · SBOM · digest
Workload
ECS / EKS roles · Secrets Manager · Pod Identity
Runtime & evidence
GuardDuty · Security Hub · CloudTrail
Why Choose Walturn for Security & Compliance?
Product, not a report
You get an app that keeps working after the engagement, not a PDF of findings.
Human in the loop by design
Every change is a pull request a person approves. The agent writes; your team decides.
The team behind Steve and Vibe Studio
The same model picker, the same connection flows, the same care for how a tool feels on day one.
Frameworks documented, not promised
Eight compliance guides on this site, written by the people who build to them.
Questions teams ask before connecting.
Does it need write access to my AWS account?
No. The CloudFormation stack creates a read-only role. The app reads Inspector findings and lists images; it cannot change resources.
What if Amazon Inspector is not enabled?
What does a fix cost?
Can I use GitLab?
What happens when a pull request fails its checks?
Can I run it on both AWS and Railway?
Got a backlog of CVEs?
Connect your cloud, Linear and your repos. Setup takes about three minutes.
