For engineering
Security fixes that arrive as a pull request you can read.
Security tickets usually land on you as a finding and a deadline. ACSE sends the fix instead: a small, validated change to your own Terraform, opened as a draft in your repository with the plan and checks attached. You review it like any other change, and nothing reaches the cloud until you merge.
Less investigation
The change is already written and tested against a plan, so you review a change instead of researching a finding.
Your pipeline stays in charge
ACSE never writes to your cloud and never merges. Fixes go through your normal review and deployment.
No more drift from hotfixes
Fixes land in the code that owns the resource, so the next apply keeps them instead of undoing them.
In every pull request
What a fix comes with
- The change
- A minimal edit at the exact commit, in the file and module that own the resource
- The plan
terraform planrun offline with pinned versions- The policy re-check
- The planned state evaluated against your policy
- Blast radius
- Judged against a versioned guardrail profile
- Undo
- How to reverse the change
Shared modules
Fixed where the problem starts
If the resource comes from a core module, ACSE proposes the fix there, with version bumps through every module that consumes it, and lists each consumer before anyone approves.
Prefer to fix only your own composition? That’s an option too.
Your setup
Works with how you ship
Draft PRs on GitHub
Through a GitHub App on the repositories you choose. Marked ready for review only after approval.
Patch-only repositories
Keep ACSE read-only: it delivers a signed patch and matches your own PR to it.
Console resources
A CLI runbook with read-only checks and the fix commands, for a person to run.
Kubernetes
Manifests, Helm values and Kustomize too
For workloads on Kubernetes, the fix is a patch to the manifest, Helm values or Kustomize overlay, dry-run offline against the API schemas before you see it.
Questions
What people ask us
Who approves the fix before I see it as ready?
A Security Approver, who isn’t the author, decides in ACSE with step-up MFA. Then the draft is marked ready for review and your normal review applies.
Is the code AI-generated?
No. Fixes come from remediation directives applied by a deterministic engine. Optional AI drafts are labelled and pass the same validation.
What permissions does the GitHub App need?
For draft pull requests, contents and pull request write on the repositories you choose. In patch-only mode, read-only access is enough.
What if a fix breaks something?
Every approval view includes how to undo the change. After the merge, ACSE re-reads the resource to verify the outcome, and reopens the case if it drifts.
Keep reading
Related
Fix
ACSE turns a cloud misconfiguration into a validated pull request in your own Terraform, generated by rules and approved by a person. Never auto-merged.
ReadSolutionsIaC security
ACSE fixes cloud misconfigurations in the Terraform that owns them, as validated draft pull requests or signed patches, so your code and cloud stay in step.
ReadPlatformIntegrations
ACSE works with the tools your teams already use: GitHub and Terraform for fixes, your OIDC identity provider for sign-in and MFA, Teams and your SIEM.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.