DevOps & CI/CD
fixdossier
Evidence collection for security fixes in your GitHub repo
Free GitHub Action that collects dated security-fix evidence from releases, advisories, Dependabot/Renovate, and commits for review, with optional hosted
Overview
The fixdossier homepage
fixdossier is a free GitHub Action that collects dated security-fix evidence from your repository history. It reads releases, tags, published GitHub security advisories, merged Dependabot and Renovate pull requests, and security-looking commits, then writes a dated fix record and support-period policy for review.
The tool generates three files: a dated fix log in Markdown, machine-readable JSON output, and a support policy built from your inputs. It is designed for evidence collection and review support, not as a complete security-fix inventory, with transparent mapping methods showing how each fix was identified.
fixdossier Pro adds a hosted multi-repository review workspace where engineers can classify and sign off on security candidates via OIDC CI ingestion with zero long-lived repository secrets, and export signed Evidence Packs as PDF and ZIP with Ed25519 signatures and append-only audit trails.
Capabilities
- Collects security-fix evidence from releases, tags, GitHub security advisories, Dependabot/Renovate PRs, and commits
- Generates dated fix record with transparent mapping methods
- Creates machine-readable JSON output (fixdossier/v1 schema)
- Generates support policy with security support dates per release
- Pro: OIDC CI ingestion with zero long-lived repository secrets
- Pro: Human sign-off with append-only review ledger and reviewer attribution
- Pro: Export Ed25519-signed Evidence Packs as PDF and ZIP
- Runs on every release and weekly with default GITHUB_TOKEN
- Notes permission gaps instead of failing the run
Pricing
Pricing model: Freemium
Free GitHub Action (MIT license). fixdossier Pro: €69 one-time founding licence (tax included via Dodo Payments, no recurring annual fee) for first 50 GitHub Organizations, includes 1 GitHub organization, up to 3 repositories/products, up to 5 reviewers, up to 24 Final Evidence Packs per year, 60 Dr
Follow fixdossier to get an email when they post a milestone, ship a new product or add a demo video.
fixdossier fact sheet
| Community votes | 0 |
|---|---|
| Based in | Germany |
| Website | fixdossier.dev |
fixdossier metrics
Vendor metrics for fixdossier.dev: Ahrefs Domain Rating and Majestic link data, with the delta since the last review.
- Domain Rating
- 0
- no change since last check
- Trust Flow
- 0
- no change since last check
- Citation Flow
- 12
- no change since last check
- Referring domains
- 2
- no change since last check
- External backlinks
- 7
- no change since last check
Vendor Domain Rating (Ahrefs) checked 6 Nov 2026, spec changed 31 Oct 2026. Vendor Majestic data checked 31 Oct 2026, spec changed 31 Oct 2026. Link metrics supplied by Majestic. Trust Flow, Citation Flow and Topical Trust Flow are trademarks of Majestic-12 Ltd.
fixdossier vendor domain
Open the vendor record
We read this from the registry's RDAP record on 6 Nov 2026, 01:09 UTC.
- Domain age
- 13 days
- Registered
- Expires
- Registrar
- CloudFlare, Inc.
- DNSSEC
- Not signed
fixdossier post-launch report
| Measure | At launch, then latest |
|---|---|
| Domain Rating (Ahrefs) | 0 to 0 no change since launch 31 Oct 2026, then 5 Nov 2026 |
| Trust Flow (Majestic) | 0 first measured 31 Oct 2026 |
| Referring domains (Majestic) | 2 first measured 31 Oct 2026 |
Day 5 since launch. Next receipt: day 30, 30 Nov 2026. Many things move these figures, so a change is not proof of cause. Only stored readings are shown.
About to launch?
Plan your launch with our free playbook, from preparing your listing to choosing more launch directories.
- The week before
- On the day
- Week one
- Beyond launch
Buyer questions
What does fixdossier collect?
fixdossier collects dated security-fix evidence from releases, tags, published GitHub security advisories, merged Dependabot and Renovate pull requests, and commits whose messages look like security fixes (CVE, GHSA, or keywords like XSS/SSRF/RCE).
Is fixdossier a complete security-fix inventory?
No, fixdossier is not a complete security-fix inventory. The record is compiled automatically and fixes with no keyword or advisory are missed, and release mapping can be wrong for backports, so you must review it.
What are the three output files fixdossier generates?
fixdossier generates three files: SECURITY-RECORD.md (a dated fix log for review), security-record.json (machine-readable data with fixdossier/v1 schema for tooling and audits), and SUPPORT.md (a support policy with supported-until dates per release).
What does fixdossier Pro add?
fixdossier Pro adds a hosted multi-repository review workspace where CI uploads security evidence via OIDC with zero long-lived secrets, engineers classify and sign off on candidates, and you export Ed25519-signed Evidence Packs as PDF and ZIP with append-only audit trails for customer questionnaires or archives.
Does fixdossier make my product compliant with EU regulations?
No. fixdossier is an engineering tool for evidence collection and review support only. It does not make any product compliant or certified with the Product Liability Directive, Cyber Resilience Act, or anything else, and it does not limit liability.
Leave a review for fixdossier
No customer reviews of fixdossier yet. Write the first. Customer reviews are free and nobody can buy them.
fixdossier has a free listing. The owner can unlock the full profile with a paid launch for $5:
- Founder story (locked)
- Milestones (locked)
- Demo video (locked)
- Dofollow website link (locked)
Compare with
| # | Product | DR | Votes |
|---|---|---|---|
| 1 |  Flowrensic™Forensics for durable execution |
2 +1 (up) since last check | 0 votes. Log in to vote for Flowrensic™ as a buyer |
| 2 |  BuildkiteProgrammable CI orchestration for AI |
76 no change since last check | 0 votes. Log in to vote for Buildkite as a buyer |
| 3 |  Queue |
0 no change since last check | 0 votes. Log in to vote for QueueForge as a buyer |
| 4 |  CDvizOpen-source CI/CD observability platform for monitoring software delivery pipelines |
10 no change since last check | 0 votes. Log in to vote for CDviz as a buyer |