Questions teams ask before joining the pilot.
Three sets of answers: who the design-partner cohort fits, what the CVE remediation pipeline actually covers, and what happens once you apply for a pilot seat. Pull requests are always optional, kill-switch is always on, and week six is a no-pressure decision.
How to read this page
- Cohort fit — who the six-week pilot is built for, and who it is not
- Pipeline scope — what kinds of CVEs the loop covers and what it ships as a PR
- After you apply — kickoff timeline, who reviews, and how to opt out cleanly
Cohort fit
Who the design-partner cohort is built for.
Six-week pilot, no cost, six partner seats. The questions teams ask before committing their review time.
Pipeline scope
What the CVE pipeline covers and ships.
Operating system, runtime, and library CVEs against your real dependency graph. Pre-disclosure handling and the false-positive loop.
After you apply
What happens once an application lands.
Response time, who reads it, and the kill-switch we agree on day one — so the pilot never becomes a fire drill.
Still on the fence?
If your question isn't covered above, send us the shape of your dependency graph, your disclosure window, and what your team has tried. We'll come back with a concrete answer — pilot fit or honest no — usually within a business day.