Can you fix findings from any pentest firm's report?

Yes, if the report names each finding and where it is in the code. The evidence pack keeps the report's own finding IDs, so your tester can match every fix to the finding it closes.

Which languages do you cover?

Railo's engine fixes common issues in Python, JavaScript & TypeScript, Java, Go and PHP automatically. We fix the rest by hand, including Ruby and C#, with the same checks on every fix.

Do you need access to production?

No. We need access to the repository, scoped to the work, and we open pull requests. We never push to your branches.

What about findings that are not in the code, such as server or cloud settings?

We explain them and recommend the change, and the evidence pack lists them as still open with the reason. A Fix Sprint changes application code; it does not change your infrastructure.

Will the retest pass?

We cannot promise that: your tester decides. Every fix is rescanned before you see it, your team reviews and merges it, and the evidence pack shows what changed for each finding.

Pentest remediation

Pentest findings, fixed before your retest.

You have the report, and the retest window is running. Send us the findings. Each code-level finding comes back as a pull request your team reviews and merges, within one week, with an evidence pack that uses your report's own finding IDs.

Updated 2026-10-26 · Railo

Who fixes pentest findings?

Usually the company that was tested. A penetration testing firm reports findings and retests them; writing the fixes is the client's work. On platforms such as Cobalt and HackerOne, the customer fixes a finding and then asks for the retest. Railo does that middle step: it fixes the findings in your code, so the retest runs against fixed code.

Retest windows at common providers

The retest is usually included only for a limited time after the test. These are the providers' own published terms. Your contract may differ, so check it.

Published retest terms of pentest providers
Provider	What they publish	Source
Triaxiom Security	One retest within 90 days of the end of the assessment, included in the price. It checks the original findings only.	triaxiomsecurity.com
HackerOne pentests	A remediation period, typically 30 or 90 calendar days, with unlimited retests at no extra cost. Afterwards you set a fee per retest, at least USD 50.	docs.hackerone.com
Cobalt	Retests completed within 7 days of submission. Free retesting for 6 months on Standard and 12 months on Premium and Enterprise, within an active contract.	docs.cobalt.io

Checked on 26 October 2026.

What you send us

The report, or an export of the findings: PDF, CSV or the platform's export.
Access to the repository through GitHub, scoped to the work. We sign your NDA before any access.
Which findings are in scope. We agree this with you in one short call, and in writing.

What you get back

One pull request per weakness, against your repository. Your CI runs on it, and your team merges it.
Every fix rescanned before you see it: the finding must be gone, and nothing new may appear.
Findings that a code change would get wrong are explained instead, with the change we recommend, and stay listed as open.
An evidence pack with one row per finding, under your report's IDs. Three rows from a real one:

Rows from the sample evidence pack
ID	Finding	File	Outcome	Checked	Pull request
F-001	Code injection (CWE-94)	`app/routes/contributions.js`	Fixed	Finding gone, nothing new	#4, merged 2026-10-14
F-004	Open redirect (CWE-601)	`app/routes/index.js`	Fixed	Finding gone, nothing new	#1, merged 2026-10-14
F-007	Hardcoded secret (CWE-798)	`artifacts/cert/server.key`	Explained, not changed	Not changed	None

The full pack, from a rehearsal sprint on OWASP NodeGoat, is on the sample evidence page, with a CSV download.

Price and timeline

A Fix Sprint is USD 1,500 for one repository and up to 25 findings. A larger report is quoted before any work starts. Pull requests arrive within one week of the scoping call, followed by the evidence pack. You then book the retest with your tester as usual.

What we do not do

We do not test. We fix what your tester found, and we do not sell penetration tests.
We do not change servers, cloud settings or architecture. We explain those findings instead.
We do not merge for you or push to your branches.
We do not promise the retest will find nothing. Your tester decides.

Pentest firm? The partners page explains how referrals work.

Questions

Can you fix findings from any pentest firm's report?: Yes, if the report names each finding and where it is in the code. The evidence pack keeps the report's own finding IDs, so your tester can match every fix to the finding it closes.
Which languages do you cover?: Railo's engine fixes common issues in Python, JavaScript & TypeScript, Java, Go and PHP automatically. We fix the rest by hand, including Ruby and C#, with the same checks on every fix.
Do you need access to production?: No. We need access to the repository, scoped to the work, and we open pull requests. We never push to your branches.
What about findings that are not in the code, such as server or cloud settings?: We explain them and recommend the change, and the evidence pack lists them as still open with the reason. A Fix Sprint changes application code; it does not change your infrastructure.
Will the retest pass?: We cannot promise that: your tester decides. Every fix is rescanned before you see it, your team reviews and merges it, and the evidence pack shows what changed for each finding.

Have findings to clear?

Send us the report. We scope it with you in one short call and sign your NDA first.

Start a Fix Sprint