Factory Turns Vulnerability Alerts Into PRs

Factory is targeting the real DevSecOps bottleneck: not finding vulnerabilities, but safely shipping fixes at scale.

• –Cross-repository analysis helps identify where vulnerable dependencies or runtime versions are actually used.
• –Droids can update packages or base images, validate changes, and create auditable PRs.
• –Built-in security review checks PRs against STRIDE, OWASP, LLM security, and supply-chain risks.
• –Human review remains essential because automated dependency upgrades can introduce regressions or new risks.
• –The strongest value is workflow compression: one advisory can trigger coordinated remediation instead of a manual repository-by-repository investigation.