Security patches that don't break production
Aikido backports CVE fixes to the exact version pinned in your lockfile. Same package, version string & APIs. No rewriting code, just merge a PR.
You found a CVE but solving it requires a major version upgrade
.avif)
Breaking API changes
New versions often ship with API changes that require devs to rewrite their existing codebase.
High effort
Refactoring code, updating dependencies, and re-testing integrations can take weeks.
Verification burden
One missed edge case can break production. Testing must be exhaustive.
Aikido patches the CVE on the version you are already running
.avif)
.avif)
Focus on building, not breaking changes
Delete your CVE backlog
Vulnerabilities get patched, drop-in replacements automatically.
Take pressure off team
Stop making developers balance time between product and security by reducing the security burden.
Focus resources on roadmap
Deliver more business value by reducing time spent on security patching.
Get immediate protection
Patched libraries on your same version are the fastest way to close CVEs.
“Aikido let our engineers get back to what they do best building advanced defense systems without getting bogged down in CVE cleanup. It's helped us win projects, build trust, and stay ahead of schedule.”
Sam StentonHead of DevOps & Platform, SiXworks
Security patches shipped daily. Fix CVEs within SLA.
New patches per day
Known Exploit Vulnerabilities
Critical & High CVEs
Medium to low CVEs
Aikido Libraries explained in 4 min.
Fix security vulnerabilities in your dependencies without breaking changes or version upgrades.
See Aikido in action
Enter your work email to view the video
.avif)
Fix your CVEs without breaking production
Aikido creates CVE-free libraries at an unprecedented pace,
enabling you to fix vulnerabilities for all projects without risking breaking changes.
FAQs about Aikido Libraries
Standard AutoFix suggests the smallest version bump that fixes the CVE. You still upgrade.
Aikido Libraries does not upgrade you. It backports the security fix into the exact version you already use.
The version string stays the same. The public API stays the same. Behavior should stay the same.
You can use both. Protected repos still get standard AutoFix for issues that are not in the pinned dependency set.
Aikido creates secured variants of the exact versions in your lockfile.
It adds a +aikido.N suffix.
Example: starlette 0.27.0 becomes starlette 0.27.0+aikido.1.
The package name stays the same. The base version stays the same. Only the suffix is new.
For npm, we use a hyphen instead of a plus sign. Example: 2.5.0-aikido.1.
Aikido Libraries supports npm, PyPI, Maven, Go, NuGet, and Composer.
Coverage depends on the ecosystem.
The Library Catalog shows which packages and versions are available for your lockfile.
It works for both.
It is most useful when upgrades are risky.
That includes legacy services and unmaintained dependencies.
It also includes pinned transitive dependencies you do not control.
For fast-moving repos, a normal AutoFix upgrade can be the quickest option.
Use Aikido Libraries when the upgrade is the problem.
Aikido Libraries is a one-year subscription per protected repo.
You pay with Aikido credits.
We show the credit cost before you confirm.
The subscription renews each year until you cancel.
Full details are in the docs.
Aikido patches new vulnerabilities and includes them in daily AutoFix PRs.
You do not need to re-protect the repo.
Protection is continuous.
If we do not have a patched variant yet, we will produce one and ship it in a future PR.