Bastion

The description states that Bastion is a GitHub App that:

• Scans a repository's dependency manifest on every push
• Resolves dependencies to known CVEs via OSV.dev
• Enriches findings with EPSS exploit-probability scores and CISA KEV status
• Proposes patches using GPT-5.6 with unified diffs and plain-language rationale
• Runs proposals through an OPA/Rego policy engine to decide outcomes:
  • Auto: opens and merges PR automatically (when safe)
  • Ask: opens PR and emails maintainer (when risky but not clear)
  • Block: opens issue without code changes (when major version bump or low signal)

The author claims the product is end-to-end functional, including real GitHub App actions, webhook receivers, and pipeline orchestration.

Evidence Self-reported by the author. No independent verification of functionality or deployment.

The author positions Bastion as a solution to a specific problem in security workflows:

• Security teams are overwhelmed by CVE alerts
• Most tools tell you what's vulnerable but not what’s safe to auto-fix
• Real incidents happen due to either no patching or unsafe auto-merging

The core claim is that Bastion closes this gap without letting an LLM decide safety — instead, it uses policy code (Rego) to make decisions.

It also emphasizes:

• The autonomy boundary lives in readable, auditable policy code
• Not the prompt or model
• The tool is built with a focus on reliability and auditability

Evidence Self-reported. No external positioning, branding, or market analysis provided.

The description implies that Bastion targets:

• Security teams who manage dependencies in software projects
• Maintainers of open-source repositories using GitHub
• Organizations with dependency scanning pipelines looking to automate patching decisions

It is described as a GitHub App, suggesting it's intended for use within the GitHub ecosystem.

Evidence Self-reported. No evidence of customer segmentation, personas, or target accounts identified.

There is no mention of pricing, monetization, or business model in the description.

The author states that Bastion was built during a hackathon and is not independently verified.

Evidence Not evidenced.

Key technical elements mentioned:

• Built using Codex (both Cloud and CLI)
• Uses GPT-5.6 for patch generation
• Integrates with OSV.dev, EPSS, CISA KEV
• Implements OPA/Rego policies for decision-making
• Delivered as a GitHub App
• Utilizes FastAPI, PyGithub, Docker, Render, Resend

The author notes that:

• The pipeline was built in two phases: Codex Cloud (initial), then Codex CLI (due to instability)
• Policy logic was written by hand
• All modules shipped with test coverage verified against pytest output

Evidence Self-reported. No evidence of production deployment, scalability, or infrastructure details.

There is no evidence of:

• Revenue
• Customers
• Adoption metrics
• Product usage data
• Deployment status beyond the hackathon

The author describes Bastion as a working prototype built in one week, with 53 passing tests and real GitHub App behavior — but does not indicate any ongoing or post-hackathon use.

Evidence Not evidenced.

No mention of competitors or competitive landscape is provided in the description.

The author does not reference existing tools for dependency patching, vulnerability management, or GitHub integrations.

Evidence Not evidenced.

• Single-person development: The entire project was built by one individual (Kirthik Venkatram), with no evidence of team or ongoing support.
• Hackathon origin: The tool is described as a hackathon submission, implying it may not have been designed for long-term productization.
• No production deployment: There is no indication that Bastion has been deployed in real environments beyond the author’s own testing.
• Unverified claims: All functionality and behavior are self-reported without third-party validation or audit.
• Limited scope: The tool supports only Python manifests (package.json, requirements.txt, pyproject.toml), with future expansion noted as a "next step".

Inference Given its hackathon origin and single developer, the likelihood of sustained product development or commercial viability is low unless further steps are taken.

1. What is the current status of Bastion post-hackathon? Has it been deployed in any real environments?
2. Are there any plans to expand support beyond Python manifests (Go, Rust, Java)?
3. How does the policy engine scale with increasing numbers of CVEs or repositories?
4. What are the actual costs associated with running this tool at scale?
5. Has the author considered how to integrate Bastion into existing CI/CD pipelines or security workflows?
6. Are there any known limitations or edge cases in the current implementation that could affect reliability?