Closing vulnerabilities at Fortune 25 bank scale.
A Fortune 25 bank with more than 200,000 repositories closes vulnerabilities through a repeatable process built on Moderne. When a frontier model found a critical vulnerability, the bank used the process to lower it two severity levels and fix every affected repository with one recipe.
- Financial services
- Industry
- 200,000+
- Repositories at the bank
The bank built a repeatable process for fixing vulnerabilities across its 200,000 repositories.
Moderne finds every repository that has a vulnerability by running a recipe against Lossless Semantic Trees (LSTs) of the bank’s code. The recipe works from compiler-accurate data, so it catches calls that a coding agent searching file by file would miss, and it uses no tokens.
A coding agent then writes one recipe for the fix, and engineers review it once. The bank’s agent checks that each change builds before it opens a pull request. Changes that fail go back to the team that owns the code for triage, and engineers finish any edge cases with coding agents or by hand.
The bank’s remediation program started as a way to fix code quality issues across many repositories at once. Now that frontier models like Anthropic’s Mythos find vulnerabilities faster than teams can fix them one at a time, the bank uses the same recipes and build checks to fix vulnerabilities across its repositories.
The same process now closes vulnerabilities as fast as frontier models find them.
When a Spring Security vulnerability landed in April, Moderne’s team built the recipe that found every affected repository. In July, when a frontier model found the critical vulnerability described below, the bank’s team scoped and fixed it on its own. The bank’s engineers now write their own recipes with coding agents, so they can scope and fix new vulnerabilities as they are discovered.
The bank lowered a critical vulnerability by two severity levels after Moderne showed which repositories had it.
When a frontier model found a critical vulnerability, a recipe run across more than 200,000 repositories showed that only a fraction were affected, all in applications that weren’t critical to the bank. Security had rated the vulnerability V1, the top of the bank’s severity scale, before anyone knew which repositories it affected. After the analysis, security lowered it to V3. Engineers then had Claude Code write the fix as a recipe, reviewed it once, and ran it on every affected repository using Moderne.
The downgrade meant the bank could fix the vulnerability without stopping other critical work, which drew kudos from the bank’s engineering leaders. At V1, every team whose code might be vulnerable can get pulled into an all-hands emergency, but a V3 goes through the bank’s regular remediation work, so only the teams that own affected code have fixes to make.
Related resources
See deterministic, estate-wide code change on your own repositories.