Gatecite

For software teams with few or no security people

Your first-line vulnerability engineer.

Gatecite reads the advisories and vendor incidents that touch what you run, decides how urgent each one is for you by your own rules, with a citation, and prepares the fix or the message for your review. Every decision cited. Every action approved by your people.

Ask for a 15-minute demo

Private beta with a small number of design partners.

The things that break you are rarely in your code

A dependency turns out to be vulnerable, exploited or malicious. A vendor you rely on goes down. Each time someone works out by hand, under pressure, which of your services it touches, how bad it is for you and what to do — and then chases it until it is done. Scanners stop at a list; status pages stop at an alert.

How it works

Rules decide. An agent drafts. People approve.

  1. Declare onceYour repositories, the vendors and AI models you depend on, how critical each is, and who owns what.
  2. It watchesPublic security data (OSV, CISA's known-exploited list, package registries) for every declared package, and your vendors' own status pages, every hour.
  3. Rules decide, with citationsPriority and due date by your rules, each citing the advisory or vendor update it rests on. No AI sets a priority.
  4. The engineer draftsFix pull requests, a summary of the finding, an incident update and an ask for each team. A rule check holds back any draft that claims what the records do not say.
  5. Your people approveOne queue and a daily briefing. Nothing merges or sends itself.

What it does today

Built, running, and shown live on a call with a made-up team.

Findings with due datesFor every declared repository, cited to public advisories, with the fix to apply and an owner. Reads the Dependabot alerts and the Trivy, Grype and OSV-Scanner reports you already have.
Fix pull requestsFor uv, pip requirements, Poetry, npm, pnpm, Yarn and Go modules. A person asks; the change is checked and opened for review. It never merges.
An upgrade gateHolds brand-new and malicious releases in your dependency pull requests before they land.
Zero-day modeA known-exploited or malicious advisory on something you run opens an incident listing every place it is open, drafts the update and the asks for each team, and closes when the last place is fixed.
Vendor outage watchMatches a vendor's incident to the components and models you declared, sets the priority by your rules, and drafts what to do — including a fallback pull request.
Follow-up and briefingTickets in GitHub or Linear, a daily briefing by e-mail, fix pull requests that stall, overdue work, and time-to-fix against your targets.

Built to be trusted

  • Deterministic decisions. The same records give the same priority, every time, with the citation shown.
  • Limits the agent cannot widen. It drafts the actions your rules allow; it cannot merge, delete, or change its own limits.
  • Your own instance. Each team gets a separate instance, reachable only by the people it names.
  • Your data stays yours. Your team's data goes to no AI model unless you approve it.

What we do not claim: no compliance guarantee, no detection faster than a vendor's own status page, and no replacement for your security people — Gatecite does their first-line work and leaves the decisions to them.

Become a design partner

About 30 minutes with us to declare your repositories and vendors, one to three people with access, and a short note each week on what was wrong or missing.

hello@gatecite.com