AutoPatch

AutoPatch turns static-analysis alerts (SARIF, Semgrep, CodeQL-style) into fix pull requests that are only proposed after mechanical verification. For each alert it generates a minimal patch plus a regression test, then runs three sandbox gates in an isolated repo copy: the test must fail on the vulnerable code, pass after the patch, and the existing suite must show no new failures. Unverifiable patches are rejected with feedback to the model (up to 3 attempts); alerts judged to be false positives are triaged instead of cosmetically "fixed". It supports Python and JavaScript/TypeScript, multi-file patches with structure-aware context (only the enclosing function of large files is patched), and deterministic dependency-CVE bumps with lockfile regeneration. The problem it solves: scanners produce alert backlogs that engineers must still understand, fix, test and prove by hand. AutoPatch closes that loop and shows its evidence in the PR. Measured on its benchmark corpus: 5/8 verified fixes offline, 8/8 with the live Meta API. Tested on a real production codebase, where its first PR was reviewed and closed as a false positive. The learnings (triage, outcome-based tests, suite-native test placement) shipped as product changes. Open-source (MIT), zero runtime dependencies.