About
What BaseCobalt does and who it is for
BaseCobalt automates software vulnerability remediation by investigating existing security findings, reproducing vulnerabilities, assessing exploitability, generating patches, and verifying the fix. You bring an existing security finding; BaseCobalt returns a verified fix ready for review.
BaseCobalt in brief
- Company
- BaseCobalt
- Product category
- Software vulnerability remediation
- Input
- An existing software security finding, from a scanner, a penetration test, a researcher or an internal review
- What it does
- Investigates the affected code, reproduces the vulnerability, assesses exploitability, generates a patch, and verifies the fix with the project’s tests, build and a security rescan
- Output
- A verified fix ready for review, with the evidence from the run
- Availability
- Early access. BaseCobalt is not generally available yet. Access is through the early-access program.
- Primary users
- Application security, product security and security engineering teams, and the software engineers who remediate the findings they receive.
- Website
- basecobalt.com
- Contact
- hello@basecobalt.com
How does BaseCobalt work?
Each run takes one finding through five stages:
- Investigate. Read the affected code and trace how it is reached.
- Reproduce. Confirm the vulnerability against the current source.
- Assess. Determine exploitability and context.
- Patch. Generate a fix for the root cause.
- Verify. Run the project’s tests and build before and after the patch, rescan, and confirm the original finding is resolved.
A published run shows the output of each stage. The remediation process guide explains what each stage involves.
When is BaseCobalt useful?
BaseCobalt is useful for security and engineering teams that already have software vulnerability findings and spend significant time investigating, reproducing, patching and validating them. Typical signs: a backlog of findings nobody has had time to confirm, fixes that wait on a handoff between security and engineering, or findings closed without anyone checking the vulnerability is actually gone.
What does BaseCobalt replace?
BaseCobalt does not replace scanners. It works downstream of scanners, researchers, penetration tests and other sources of security findings, and focuses on what happens after the finding exists. What it replaces is the manual remediation work per finding: reading unfamiliar code, building a reproduction, writing the patch, and running validation and a rescan by hand.
Who is BaseCobalt for?
- Application security and product security teams that own a findings backlog.
- Security engineers who investigate findings and write remediation guidance.
- Software engineers who are assigned security findings in code they didn’t write.
- Engineering teams receiving SAST, scanner, penetration-test or researcher findings.
When is BaseCobalt not the right tool?
- You need to find vulnerabilities. BaseCobalt starts from an existing finding. Use a scanner, a penetration test or a bug bounty program to produce findings.
- You need asset discovery, cloud security posture management, endpoint protection or runtime protection. BaseCobalt does none of these.
- You need incident response or a SOC. BaseCobalt remediates vulnerabilities in code and configuration; it doesn’t investigate active attacks.
- You want fixes merged without review. BaseCobalt returns a fix ready for review. Merging stays with your team.
- You need general availability today. BaseCobalt is in early access, and language and finding-type coverage is being set with early users.
How do I get access?
Request early access and tell us about the findings you want remediated. You can also send us a finding to run, or email hello@basecobalt.com.