Running a Code Remediation Campaign using Strobes AI

Overview

A Code Remediation Campaign in Strobes helps you fix the security vulnerabilities already found in your source code. An AI agent imports your existing findings, maps them to specific files and lines, prioritizes them by risk, generates minimal code fixes, and creates pull requests for your team to review. It then verifies each fix by re-scanning the patched code and tracks the progress of the campaign across your repositories.

The campaign typically takes 1 to 4 hours. You can track each vulnerability as fixed, in progress, or deferred, with every pull request linked back to its Strobes finding. A campaign report shows the fix rate by severity, the remaining work, and any blockers.

Why Is It Needed?

Finding vulnerabilities is only half of the work. Teams often have long backlogs of findings and limited time to fix them. A remediation campaign turns that backlog into ready-to-review pull requests, so developers spend their time reviewing fixes instead of writing them from scratch.

Each pull request links back to its Strobes finding, so you can trace every fix from the finding to the code change, and see what is fixed, what is in progress, and what is blocked. It is a good fit for clearing a backlog of code vulnerabilities, fixing the findings from a recent scan or audit, and keeping repositories clean with a recurring fix cycle.

Prerequisites

Before you start, make sure you have:

• Access to Strobes AI Workspaces in your organization.
• Enough AI credits. Each run uses AI credits.
• Repository URL: The URL of the repository you want to remediate.
• Source code platform access: A GitHub, Bitbucket, or Azure DevOps credential with permission to open pull requests. Without it, Strobes cannot create the remediation pull requests.
• Findings to fix: Existing findings in Strobes for the repository, or a findings file (CSV, JSON, or SARIF) to import.
• Authorization to change the repository.

Accessing the Code Remediation Campaign Template

1. Navigate to AI from the main navigation menu.

2. Open the Workspaces page.

3. Click New Workspace.

4. In the Playbook Library, search for remediation and select the Code Remediation Campaign template.

5. Review the template details.

Selecting the template opens its details page, which shows:

• Tags: The category, number of phases, version, and expected duration.
• About: What the template does.
• What you'll need: A GitHub or Bitbucket connection.
• What to expect: Existing findings imported and mapped to specific files and lines, vulnerabilities prioritized by severity, exploitability, and fix complexity, minimal and targeted code patches for each vulnerability, pull requests with clear descriptions linking to findings, fixes verified by re-scanning the patched code, and every pull request linked back to its Strobes finding.
• Outputs & deliverables: Remediation Status, Pull Requests, and a Campaign Report.
• Standards & coverage: CWE/CVSS and dependency CVEs.
• Workflow phases: The 6 phases, in order.

To continue, select Use this template. To choose a different template, select Back or Back to templates.

6. Click Use this template.

Configuring the Repository Scope

After selecting the template, the wizard automatically moves to the Scope step.

Step 1: Provide a Workspace Name

The workspace name is pre-filled with the template name. Enter a more meaningful name for the campaign if you want, such as the repository or team name.

Step 2: Enter the Repository URL

In Repository URL (required), enter the URL of the repository this campaign will remediate, for example https://github.com/org/repo.

Step 3: Connect a Source Code Platform (Optional)

Under Source code platform, select an existing credential from the list, or click Connect GitHub, Connect Bitbucket, or Connect Azure DevOps to add a new one. Strobes uses this connection to open the remediation pull requests, so connect a provider if you want the campaign to create them. Ensure the credential has access to the repository.

Step 4: Choose Which Findings to Fix

Open the Findings to fix dropdown and select the scope of the campaign:

Step 5: Import a Findings File (Optional)

Under Findings file, click Add file and upload your findings in CSV, JSON, or SARIF format.

Step 6: Add Other Credentials (Optional)

Under Other Credentials, select additional credentials from the credential manager, or click Create a new credential set to add them.

Step 7: Add Custom Instructions (Optional)

Use the Custom Instructions field to guide the campaign.

Example instructions:

• Fix only dependency vulnerabilities.
• Do not change files in the tests folder.
• Prioritize the authentication module.

These instructions help tailor the AI analysis to specific objectives.

Step 8: Proceed to Configuration

After completing the scope details:

1. Verify the repository URL and the findings scope.
2. Click Next.

The Next button stays unavailable until the repository URL is entered. The wizard then proceeds to the Configure step.

Configuring the Run

Step 9: Select an AI Model

The Agent model determines the Large Language Model (LLM) used during the campaign.

1. Open the Agent model dropdown.
2. Review the available models and their Strobes BMS scores.
3. Select the model that best fits your requirements, or choose Smart Router to let Strobes pick the best model for each task.

Step 10: Select the Execution Shell

The Execution shell defines where the agent runs its commands. Cloud sandbox is selected by default. If you need the agent to run from one of your own hosts, open the Execution shell dropdown and select it instead.

Step 11: Review the Browser

The Browser is Cloud Browser by default. Keep the default.

Step 12: Select the Execution Mode

Choose how the AI runs the campaign. Autonomous is selected by default.

• Autonomous: The AI runs all phases without pausing for approval.
• Human-in-the-loop: The AI pauses at each phase gate and waits for your approval before continuing.

Because this campaign opens pull requests in your repository, Human-in-the-loop is a good choice if you want to approve the fixes before they are submitted.

Step 13: Select the Schedule

Choose how often the campaign runs:

Step 14: Click Next

Once all configuration settings have been verified, click Next. The wizard opens the Review page.

Step 15: Review and Launch the Workspace

Review the configuration summary, including the playbook, workspace name, deployment, execution mode, target, phases, and agent model.

Strobes automatically checks whether the target is reachable. Once everything looks correct, click Launch workspace to start the campaign. When it completes, the pull requests appear in your repository, linked to their Strobes findings, and the campaign report is available in the workspace.

Tips

• Connect a source code platform. Without it, Strobes cannot open the remediation pull requests.
• Start with Critical & High only. It keeps the first campaign small and easy to review. Switch to All open findings once you are comfortable with the results.
• Always review the pull requests before merging. The agent generates minimal fixes, and your team should confirm that each one is correct.
• Use Human-in-the-loop if you want to approve each phase before the agent submits pull requests.
• Use the Weekly fix cycle to keep new vulnerabilities from piling up.
• Use Custom Instructions to exclude files or folders, or to focus on specific modules.
• The campaign typically takes 1 to 4 hours, depending on the number of findings and the size of the repository.
• Only run campaigns on repositories you are authorized to change.