Railo
Railo — deterministic GitHub security patch bot using AST and Z3; merge-ready fix PRs, no LLM guesswork.
Last verified:
What is Railo?
Railo is a GitHub-native AI security tool that automatically scans pull requests for vulnerabilities (SSRF, SQL injection, path traversal) and generates deterministic fix PRs with verification evidence. It eliminates manual security backlog triage by reviewing findings, preparing fixes, and labeling results with proof strength and explicit limitations.
Railo pricing
Pricing model: Freemium
Free ($0, 3 repos/200 scans monthly); Pro ($99/mo, 10 repos/2,000 scans); Team ($299/mo, 50 repos/10,000 scans); Enterprise (custom + $1,500 fixed-scope closure sprint)
Railo pros
- Verification layer shows proof strength and explicit limitations for each fix (cleared/not cleared/inconclusive)
- Deterministic fixes produce byte-identical patches from pinned commits for reproducibility
- GitHub App integration requires no CI configuration—works on every PR automatically
- Free tier includes vulnerability detection across 7 languages with no login required
Railo cons
- Limited to specific vulnerability types (SSRF, SQL injection, path traversal, etc.) rather than comprehensive coverage
- Free tier restricted to 3 repositories and 200 PR scans per month
- Fixes still require manual review and approval before merging—no auto-merge even when verified
- GitHub-only integration; no support for GitLab, Bitbucket, or other VCS platforms mentioned
Frequently asked questions about Railo
How does Railo ensure fix quality?
Each fix includes a verification step that outputs the outcome (cleared/not cleared/inconclusive) with proof strength (static_proof, heuristic, etc.), so you decide based on facts rather than faith.
Do I need to set up CI/CD pipelines?
No. Railo works through the GitHub App you already trust—install once and it automatically scans every pull request with no configuration needed.
What happens with my code after scanning?
Railo opens a companion pull request with the proposed fix and verification outcome. You review and merge manually—nothing lands without your approval.