# How River takes security work from a fix to merge

DevFeed: [How River takes security work from a fix to merge](<https://devfeed.tech/articles/how-river-takes-security-work-from-a-fix-to-merge-1554.md>)

Original publisher: [Read original article](<https://shopify.engineering/river-vulnerability-remediation>)

Author: Erin Son

Published: 2026-09-02T16:30:45Z

Content type: article

Language: en

Sources: [Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering.md>), [Shopify Engineering - Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering-shopify-engineering.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [AI Bots](<https://devfeed.tech/topics/ai-bots.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [autonomous](<https://devfeed.tech/tags/autonomous.md>), [ci](<https://devfeed.tech/tags/ci.md>), [security](<https://devfeed.tech/tags/security.md>), [shopify](<https://devfeed.tech/tags/shopify.md>), [slack](<https://devfeed.tech/tags/slack.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [workflow](<https://devfeed.tech/tags/workflow.md>)

## AI overview

Shopify describes River, an AI agent that manages vulnerability remediation from patch review through merge and verification against the repository head and dependency graph. The article reports a 70% reduction in open dependency issues during the workflow's first 11 days.

## Source excerpt

River, Shopify's AI agent in Slack, enables autonomous vulnerability remediation, not just detection.