CodeCargo Manage
A platform team for your GitHub, without the headcount.
CodeCargo watches every repository and workflow, fixes what drifts as pull requests your owners review, and brings you only the decisions that need a person. You choose how much it does on its own.
The first look is read-only: install the GitHub App, see your estate and CodeCargo's plan. Nothing changes until you say so.
Needs you · 2
Done on its own · 43
How things are going
Trusted by teams managing GitHub at scale
How it works
It runs all the time. People supervise instead of operate.
- 01
Watches everything
Every repository, workflow, setting, runner and member, checked against your standards all day, not at audit time.
- 02
Decides what matters
Fixed rules rank the work, bundle low-risk fixes into one pull request per repository, and keep everything inside your autonomy settings.
- 03
Fixes it in waves
Changes go out as pull requests to each repository's owners, in waves, inside your change windows, with the undo prepared before anything runs.
- 04
Checks the result
After a merge CodeCargo watches the next runs, undoes a change that causes a regression, and learns from what people approve and decline.
What it keeps right
The work a platform team never finishes, finished every week.
Deprecations, supply-chain incidents, cost drift, copied workflows and repositories nobody owns. CodeCargo works each area on its own schedule, at the level of autonomy you set for it.
Standards
Every repository on your building blocks.
- Replace copied workflows with shared ones
- Golden paths for new repositories
- Same merge settings everywhere
Security fixes
Workflows that are hard to attack.
- Triage every GHAS alert to a verdict
- Pin third-party actions to SHAs
- Least-privilege GITHUB_TOKEN
Supply chain
Compromised actions handled in minutes.
- Find every workflow that uses it
- Pin to the last known-good commit
- List the secrets to rotate
Cost savings
Actions spend you can explain.
- Cancel superseded runs, add caching
- Right-size runners, trim matrices
- Unused seats and stale artifacts
Build reliability
Fewer red builds blocking merges.
- Triage failed runs
- Fix flaky required checks
- Keep actions off deprecated versions
Hygiene
Years of branch slop, cleaned up.
- Delete merged branches, archive stale ones
- Revive or close abandoned pull requests
- Keep CODEOWNERS accurate
Access
The right people with the right access.
- Inactive members and outside collaborators
- Admin through teams, not people
- Offboarding as one decision
Evidence
Audits answered from what already happened.
- Who approved what, and why
- Exceptions with reasons and expiry
- SLSA levels and access reviews
GitHub Advanced Security
48,000 alerts. One answer.
Turn on GHAS across a large org and tens of thousands of Dependabot, code scanning and secret scanning alerts land at once. CodeCargo triages every one and turns the backlog into a handful of decisions.
- 41,186
Safe to dismiss
Test code, development-only and archived. One decision.
- 5,900
Close through 300 update pull requests
Grouped Dependabot updates, merged at your autonomy level
- 900
Need their owners
Routed to each service’s owning team, with a fix target
- 14
Exploitable in production now
Known exploited, runtime, internet-facing. Fix now.
Ranked by real risk
Severity, exploitability from EPSS and CISA’s known-exploited list, runtime or development dependency, repository tier and blast radius.
A verdict on every alert
Fix now, fix in a batch, accept the risk, false positive, or the owner decides, each with its evidence and a confidence.
Fixes, not tickets
Dependency updates merged under your autonomy settings, Copilot Autofix or CodeCargo for code scanning, and guided rotation for leaked secrets.
One problem, one decision
One vulnerability in 212 repositories is one finding and one decision, not 212 alerts.
Dismissals are exceptions
Each has a reason, an approver and an expiry. CodeCargo writes it back to GitHub and reopens the alert when it expires.
Only the urgent interrupts
Leaked secrets, push-protection bypasses and exploited criticals in production reach you now. Everything else is in the briefing.
You stay in control
Autonomy is a dial, not a leap of faith.
Set how much CodeCargo does on its own for each area and each tier of repository. Risky changes are always capped lower, every level is earned through a track record, and one button pauses everything.
- 0
Off
CodeCargo doesn't look at this area.
Who signs off: —
- 1
Report only
Opens a finding with its impact. No pull request, nothing changes.
Who signs off: —
- 2
Ask first
Prepares the fix as a pull request, with its undo, and holds it in your Inbox until someone approves.
Who signs off: An approver, then the repository owner
- 3
Owners review
Opens the pull request to the repository's code owners, who review and merge it like any other.
Who signs off: The repository owner
- 4
Automatic
Merges the fix once required checks pass, inside change windows, and reverts it if a later run regresses.
Who signs off: Nobody beforehand; it shows in the briefing
Each cell is how far CodeCargo goes on its own for that kind of fix, in that tier of repository. Each level is explained in the list.
| Area | Productioncustomer-facing | Standardmost repositories | Sandboxexperiments |
|---|---|---|---|
| Security fixes | Ask first | Owners review | Automatic |
| Dependency updates | Ask first | Owners review | Automatic |
| Alert triage | Ask first | Ask first | Automatic |
| Network egress | Report only | Ask first | Owners review |
| Cost savings | Owners review | Owners review | Automatic |
| Build reliability | Ask first | Owners review | Owners review |
| Branch hygiene | Report only | Ask first | Owners review |
| Access | Ask first | Ask first | Ask first |
| Developer requests | Off | Owners review | Owners review |
Reading a row: a security fix in a production repository waits for an approver; the same fix in a sandbox merges on its own once checks pass.
Always holds, at every level
- Risky changes capped at Ask first
- Undo prepared before every change
- Change windows: Mon–Thu, 09:00–17:00
- Freeze: Dec 18 – Jan 4
- At most 3 pull requests per team a day
- A wave stops at its first failure
Held back: 9 fixes wait because Security fixes in Production is Ask first.Open Inbox
Suggestion: 40 dependency updates merged in Standard repositories with none undone. Raise to Automatic?Review
Prevent, then repair
Problems stopped in the pull request that brings them in.
Every pull request that touches a workflow gets a CodeCargo standards check, in plain words, with an Apply fix button. Once a repository has met a standard for 30 days, CodeCargo proposes locking it in with a ruleset, so cleaned-up repositories stay clean.
- Advisory by default; blocking only where you choose
- Never blocks a merge if CodeCargo can't grade it
- actions/setup-node is pinned to a tag, not a commitApply fix
- GITHUB_TOKEN has write-all permissionsApply fix
- Uses the node-package building block
- No long-lived cloud credentials
The work comes to you
A handful of decisions a week, not a queue of tickets.
One decision, many repositories
Approve a change type across a scope, not pull request by pull request.
Where you already work
Approve from the Inbox, Slack or Teams. Ask @codecargo for what you need.
A weekly briefing
What changed, what it saved, what was undone and what needs you. Reply to ask a question.
- Approve
Pin third-party actions
112 repositories · Production · Low risk
- Review
Archive 38 stale repositories
Owners told 14 days ago · Medium risk
- Approve
Turn on secret scanning
Org setting · all repositories · Low risk
When something breaks upstream
A compromised action, handled as one decision.
When an action you depend on is compromised, CodeCargo finds every workflow that uses it, proposes the whole response at once, and runs it the moment one approver says yes. Every safety rule still applies; only the waiting goes away.
Scoped
9 workflows in 6 repositories use the compromised action
Contained
Action blocked in the org; every use pinned to the last known-good commit
Traced
2 runs contacted the attacker; 4 secrets they could reach, with owners
Closed
Secrets rotated, pins verified, incident report ready for the auditors
Day one
See your estate before anything changes.
Everything stays at Report only or Ask first until you grant write access, area by area, when you're ready.
- 1
Install the GitHub App
Read access is enough to start.
- 2
Get your first look
Scores by area, the five things CodeCargo would fix first, avoidable Actions spend and how many branches and pull requests are dead.
- 3
Choose how much it does
Pick a preset and tell CodeCargo which repositories are production.
- 4
Tell it where to reach you
Slack, Teams or email.
- 5
See the plan
What CodeCargo will do in each area in its first week.
Migrating to GitHub with CodeCargo?
Manage starts on the standards and building blocks you landed with, so nothing drifts after cutover.
Questions before you hand over the keys.
Security and change-management teams ask these first. We're happy to go deeper.
Will CodeCargo change anything without our approval?
Only where you allow it. Every area starts at Report only or Ask first. You raise an area to Owners review or Automatic per repository tier, risky changes are always capped lower, and one button pauses everything.
Who opens the pull requests?
CodeCargo's GitHub App, so every change is attributed to CodeCargo, not to a person's account. Each one records the area, the standard, the autonomy setting and who approved it.
What if a change breaks something?
Every change has its undo prepared before it runs. Changes go out in waves with canaries and stop on the first failure, and after a merge CodeCargo watches the next runs and undoes a change that causes a regression.
What permissions does it need?
Read access to start. Write permissions are granted area by area when you are ready, and until then CodeCargo only reports and prepares fixes for you to approve.
Does it work with Dependabot, GitHub Advanced Security and CargoWall?
Yes. CodeCargo turns on and triages GitHub Advanced Security: every Dependabot, code scanning and secret scanning alert gets a verdict, one vulnerability across many repositories is one decision, and dismissals are approved exceptions written back to GitHub. It also rolls out CargoWall from audit to enforce through CargoWall's own tools.
Will our developers be buried in pull requests?
No. Low-risk fixes are bundled into one pull request per repository, CodeCargo respects each team’s capacity and change windows, and it learns from what people decline.
Do we need to migrate with CodeCargo to use Manage?
No. Manage works on any GitHub Enterprise Cloud estate. Customers who migrate with CodeCargo start on the standards and building blocks they landed with.