How River takes security work from a fix to merge (2026) - Shopify

In the first 11 days of running their security agent, Shopify cut its open dependency vulnerability backlog by 70%. 👇

Generating automated security patches is relatively easy, but actually driving them to merge without breaking production is where teams stall out. Repositories move fast. Code changes while pull requests sit in review, sibling PRs secretly resolve dependencies under the hood, and passing CI on a stale PR doesn't prove the main branch is actually secure. Engineers end up wasting hours manually checking PRs, rebasing code, and shuttling state between Slack, GitHub, and issue trackers.

Shopify built River, an AI agent living in Slack that drives vulnerability fixes all the way from initial detection to post-merge verification. Instead of just generating diffs, River operates directly inside Shopify's monorepo environment to manage the entire operational loop alongside human developers.

When a vulnerability is flagged, River groups related fixes into Slack threads and runs through a strict sequence:

Validate live state: River compares its internal work ledger against actual GitHub and tracker state. It treats its own database as unverified claims, checking if a PR was already merged or closed. It then inspects the repository head to confirm the vulnerability is still active and wasn't already fixed by another commit.

Repair on current head: If the vulnerability remains, River replays the upgrade on the latest repository head, regenerates lockfiles, and re-triggers CI builds.

Human handoff: Code owners make the final product and risk decisions, while River stays in the Slack thread to answer questions, rebase code on demand, and preserve context for future runs.

Post-merge verification: After a PR merges, River re-checks the live repository head and the resulting dependency graph to prove the vulnerability is completely gone before marking the issue done.

During its first 11 days on dependency workflows, River eliminated roughly 70% of open security issues. Two-thirds were direct merges, while the remaining third were confirmed as obsolete or already fixed elsewhere. Overall, security patches successfully passing Shopify's freshness-gated merge queue jumped from 10% to 80%.