LegacyFixer

Built for maintainers

Automated Python dependency security, without PR noise.

LegacyFixer scans selected Python repositories, records dependency-security results, and creates review-ready pull requests only when repository settings explicitly allow it.

Start free trial
  • 7-day trial
  • Up to 3 repositories
  • No credit card required

Passive by default

Start with scan results only. No code changes are made during the recommended first onboarding run.

Review-ready PRs

When enabled, fixes are proposed through isolated branches and pull requests for human review.

Repository-level control

Each repository controls whether PR creation is enabled and how many LegacyFixer PRs can be open.

Launch video

See LegacyFixer in action

Watch the LegacyFixer launch video for a quick introduction to the project.

The YouTube player loads only after you press Play. YouTube's privacy policy applies once loaded.

Watch directly on YouTube

Get started in minutes

Start with a safe onboarding path

LegacyFixer is a self-service GitHub App. Begin with passive dependency-security scans and enable pull requests only when you're ready.

  1. 1
    Sign in with GitHub Create your workspace and connect selected Python repositories.
  2. 2
    Run passive scans first Record vulnerability findings without opening a pull request.
  3. 3
    Enable PRs deliberately Control optional fix pull requests through repository settings.
7 days · up to 3 connected repositories

The trial ends after seven days, even if fewer than three repositories are connected. Access can be revoked in GitHub settings at any time.

Start free trial

Current validated coverage

Works with real Python projects

Tested across common dependency layouts and real-world behavioral cases.

Dependency layouts

  • requirements.txt
  • nested requirements.txt
  • poetry.lock
  • Pipfile.lock
  • setup.cfg install_requires

Behavioral cases

  • passive findings
  • dependency conflict
  • dependency hell
  • PR diff granularity
  • no PR in passive mode

Best first fit: a small or medium public repository that is not production-sensitive.

Public scan example

Review a real scan result

Explore a verified historical, read-only passive scan to see what LegacyFixer records and why no pull request was created. This snapshot is not a live scan.

View public demo
Verified historical run #88
Scan completed successfully
Trigger
webhook
Run time
1m 50s
Result
NO_ACTION
Reason
passive_findings
Vulnerabilities
23 reported
PR opened
no

Independent project

Built through careful human–AI collaboration

Meet the founder and read the project story