
Python dependency security scans with optional fix PRs
Compared with Dependabot and Renovate, LegacyFixer focuses on security-first scanning of Python dependencies. It reports vulnerability findings even when an automated fix is not appropriate, and creates a fix pull request only when its policy and validation checks allow it. Each scan produces an explicit outcome, including detect-only (NO_ACTION) when no fix PR is created. LegacyFixer runs as a GitHub App on Google Cloud Run.
Scored deterministically. Only candidates that fire a story trigger are sent to a model, so this one has no written angle.
Describes itself in terms almost no other launch uses: "Python dependency security scans with optional fix PRs"
Gaps in our data, not findings about the product. Their weight is redistributed across the 5 we did measure.
A source that found nothing is a measurement. A source that has not run is a gap. Neither means the launch lacks the thing.