Product · Reversible Remediation
Every change previewed, backed up, and undoable
Detect, explain, request approval, preview the diff, apply, verify, roll back. Three change paths, one rule — no configuration you created is ever modified silently, and nothing is mutated remotely.
How it works
The order is the safety contract
Each step exists to make the next one safe. Skipping any of them is what turns a helpful tool into one you stop trusting with your machine.
- 01
Detect and explain
A finding arrives with its rule version, its evidence, why it got that severity, and how it might be wrong.
- 02
Request approval and preview
Nothing moves until someone approves, and the approval is given against the exact diff — which file, which key, what before, what after.
- 03
Apply, verify, roll back
The change writes atomically over a backup. Verification is recorded rather than assumed, and the way back exists before the way forward is taken.
Capabilities
Three change paths, each with its own consent
Different things are being changed, in different places, owned by different people. One approval model for all three would be wrong for at least two of them.
User and global configuration
Lives on the developer’s machine and belongs to them. Changes require an explicit local CLI approval. GitHub cannot see this configuration, so no server-side actor can approve it on the developer’s behalf.
Repository configuration
Belongs to the team. Changes arrive as an explanatory pull request and get reviewed like any other, with the reasoning in the description rather than in a tool nobody opens.
Team baseline adoption
Belongs to the team but lands on a machine. It is pulled, never pushed — version-pinned, previewed on the machine, and confirmed there.
Reversibility
What makes a change undoable
Reversibility is not a rollback button bolted on at the end. It is a property of the write path every change takes.
Backup before write
The original is preserved before anything is touched, so the previous state is a file rather than a memory.
Atomic write
The change lands completely or not at all. A partial failure cannot produce a configuration that neither you nor we intended.
Recorded rollback
Every applied change knows how to undo itself, and the undo is recorded in the audit trail like any other action.
Coverage
What remediation will not do
Two of these are permanent structural boundaries rather than roadmap gaps, and are worth stating plainly.
No runtime blocking
KeepRails never sits in the tool-call path. There is no proxy, no gateway, and no runtime interception — so there is nothing here that can stop a call as it happens.
No MDM deployment
Changes reach a machine because a developer ran a command, not because a device management policy pushed one.
No guessed fixes
Where a deterministic remediation does not exist, the finding needs a decision, not a patch. The product says so rather than generating something plausible.
Where it stops
No payloads are read. A tool the collectors cannot defensibly match is counted as unattributable rather than guessed into a category.
Related
Each surface feeds the next: what the scan finds becomes a finding, and a finding becomes a reversible change.
FAQs about Reversible Remediation
Will KeepRails change my configuration without asking?
No. No command silently changes a configuration you created. User and global changes require an explicit local approval, and repository changes arrive as an explanatory pull request you review like any other.
Can KeepRails push a change to my machine?
No. There is no remote silent mutation, and there is no path by which KeepRails writes to a developer machine from the cloud. Adoption is always pull-based and initiated on the machine.
What happens if applying a change fails halfway?
It cannot leave you stranded. Changes go through a backup-and-atomic-write path, so either the change lands completely or the original file stays as it was.
Does this block my merges?
Not by default. V1 is advisory — GitHub checks are informational. Hard-blocking may be evaluated later, and only if teams trust the finding quality first and ask for it.
What if there is no safe automatic fix?
Then there is no fix button. Findings without a deterministic remediation say so. KeepRails will not generate a change it cannot preview exactly.
How do I undo everything?
`keeprails uninstall` removes hook and plugin state and restores the previous configuration. Individual applied changes can be rolled back from their backup.
See what your fleet is actually running
The scan runs locally and reports in your terminal. No account, no upload.
keeprails scan