HeroDevs introduced the Evergreen Platform as growing volumes of vulnerabilities, accelerated by advances in AI models, make it increasingly difficult for engineering teams to keep up with security threats. The platform continuously monitors open-source dependencies throughout an application to identify components that no longer receive upstream security updates. When a vulnerability affects an unsupported dependency, Evergreen provides a CVE-free, drop-in replacement backed by a 14-day CVE SLA. This allows developers to address security risks while keeping their focus on product development and existing roadmaps.
Most CVEs close with a version bump. The CVEs that stay open and take the most engineering effort often sit on a version that no longer gets upstream fixes. Closing those CVEs takes a major upgrade or a patch written and maintained in-house, pulling engineers off the product roadmap. The challenge is structural, not temporary: Sonatype’s 2026 State of the Software Supply Chain Report found 81,000+ open source package versions already carrying a known CVE with no upstream fix path. With the Evergreen Platform, engineering teams close CVEs without a major upgrade or an in-house patch: a CVE-free, drop-in replacement arrives automatically as a pull request in the team’s existing workflow. HeroDevs patches every CVE on dependencies that no longer get upstream fixes, not just CVEs with an upstream fix to backport. Each replacement is built using AI at scale and reviewed and tested by HeroDevs experts before release, with the fix scoped to the security issue alone to minimize breaking changes. HeroDevs keeps patching the replacement as new CVEs land, so engineering teams stay secure in place across the entire application.
For AppSec and compliance teams, a CVE on a version that no longer gets upstream fixes is a finding that stays open. Each open finding is persistent risk in production that AppSec teams answer for but cannot close on their own. Security scanners keep reporting CVEs as they do today, and the Evergreen Platform works alongside those scanners, tracking which findings sit on unsupported versions and delivering a replacement that closes each finding. Every remediation arrives with a VEX statement and a legal attestation, evidence AppSec and compliance teams can hand to auditors for frameworks such as FedRAMP, PCI, SOC 2, HIPAA, CRA, and more.
“AI has made finding vulnerabilities fast and cheap, but what we still see is remediation happening one CVE at a time,” said Aaron Mitchell, CEO of HeroDevs. “That approach worked when CVEs arrived at a pace teams could keep up with. At more than 260 new CVEs a day, every CVE handled on its own is another project that pulls engineers off the roadmap. We built the Evergreen Platform on a different premise: remediation should happen at the application level, not one CVE at a time. Evergreen continuously tracks the entire dependency tree, and when a CVE lands on a dependency with no upstream fix, HeroDevs delivers a CVE-free, drop-in replacement. For the engineering team, what used to be a new project becomes a pull request to review and merge.”
More than 1,000 organizations, including half of the Fortune 100, already rely on HeroDevs for CVE remediation in the open source libraries their applications depend on. The Evergreen Platform, available today, extends the same CVE remediation from individual libraries to the entire dependency tree. Every replacement is reviewed and tested by HeroDevs engineers, including original maintainers of widely used open source frameworks. Almost every application runs open source that no longer gets upstream fixes, and with the Evergreen Platform, teams migrate off that open source when they choose to, not when a CVE forces the move. Engineering and security teams can start with a free exposure report on an application’s open source dependencies.
Related News:
Infragistics to Strengthen Blazor Applications Development with Microsoft
Q&A with Chris Newton-Smith, CEO of IO on Compliance Confidence
