How River takes security work from a fix to merge (2026) - Shopify

This post details the operationalization of an AI agent named River for automating security vulnerability remediation. River handles dependency upgrades and first-party application vulnerability fixes by revalidating findings against live code, repairing mechanical failures, rebasing PRs, retriggering CI, and handing off decisions requiring human judgment. It significantly reduced the backlog of open security issues and increased the rate of security merges. Key contributions include the agent's ability to revalidate findings against live repository state, repair mechanical failures caused by upgrades, and verify closure by checking repository head and tracker state after merges. The post emphasizes the importance of revalidating before editing, ensuring evidence follows code, and making handoff a deliberate part of the workflow.