Python dependency security scans with optional fix PRs
Compared with Dependabot and Renovate, LegacyFixer focuses on security-first scanning of Python dependencies. It reports vulnerability findings even when an automated fix is not appropriate, and creates a fix pull request only when its policy and validation checks allow it. Each scan produces an explicit outcome, including detect-only (NO_ACTION) when no fix PR is created. LegacyFixer runs as a GitHub App on Google Cloud Run.
Hi Product Hunt!
LegacyFixer began without a business plan or even a product idea. I was curious about AI and wanted to explore one question: Could someone without formal programming education build a real software product by working side by side with AI?
From February to August 2026, I worked with ChatGPT to find out. We discussed architecture, made technical decisions, wrote and revised code, investigated failures, and tested repeatedly. I didn't hand the project to an autonomous AI agent. Codex helped mainly with code reviews and testing.
It wasn't easy. We first ran the application on a separate server, then migrated it to Google Cloud Run and moved PostgreSQL to Cloud SQL. There were mistakes, unexpected problems, and a great deal to learn.
What surprised me was how much I loved the process. Some nights I worked until midnight, completely absorbed in what we were building. The experiment had become something personally meaningful.
Today, LegacyFixer is a working GitHub App that scans Python dependencies for security vulnerabilities and creates controlled fix pull requests only when its validation checks allow. Otherwise, it reports findings without changing the repository.
I'm here for technical feedback, critical evaluation, and real-world use cases.
LegacyFixer exists because a human and AI worked side by side.
Thanks for taking a look!
About LegacyFixer on Product Hunt
“Python dependency security scans with optional fix PRs”
LegacyFixer launched on Product Hunt on October 14th, 2026 and earned 61 upvotes and 1 comments, placing #48 on the daily leaderboard. Compared with Dependabot and Renovate, LegacyFixer focuses on security-first scanning of Python dependencies. It reports vulnerability findings even when an automated fix is not appropriate, and creates a fix pull request only when its policy and validation checks allow it. Each scan produces an explicit outcome, including detect-only (NO_ACTION) when no fix PR is created. LegacyFixer runs as a GitHub App on Google Cloud Run.
On the analytics side, LegacyFixer competes within Developer Tools, GitHub, Security and Google Cloud Run — topics that collectively have 566k followers on Product Hunt. The dashboard above tracks how LegacyFixer performed against the three products that launched closest to it on the same day.
Who hunted LegacyFixer?
LegacyFixer was hunted by Domnita Tudor. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
For a complete overview of LegacyFixer including community comment highlights and product details, visit the product overview.
Domnita Tudor