How River takes security work from a fix to merge

A good patch isn't the same as a fixed vulnerability.

Shopify operates systems that can generate dependency upgrades and draft fixes for first-party code, but they can’t drive remediation to closure. The repository can change while a PR waits for review; a developer might add context that changes what the fix should be; and passing CI on a PR doesn't prove the vulnerability has been removed from the repository head.

River is an AI agent that lives in our company Slack. As we described in Under the River, River works from the root of World, Shopify’s monorepo, using the same reproducible development environments, written-down skills, and engineering conventions as our developers. That shared substrate gives these security workflows Shopify-specific context from the start; we add the remediation logic rather than reteaching the agent how our codebase works.

In practice, engineers no longer have to shuttle state between code, CI, Slack, and the tracker; they can focus on the product and the risk decisions that require human judgement. River checks the original finding against current code, updates the patch when it can do so safely, brings in the right engineers when a decision needs their context, and follows the work after handoff. After a merge, it checks the repository head and the resulting dependency graph before calling the work ‘done.’ Now that we've operationalized the workflow for dependency and application vulnerabilities, we can share some results.