GitHub / Dependency Review / Dependabot
Package identity, installed version, vulnerable range, manifest, scope and relationship in this repository.
GitHub-native release control
EVIDENCE DECIDES.FIXES GET VERIFIED.
Limen combines repository context, independent security evidence, and deterministic policy to decide whether code should ship — then keeps blocked releases on a path toward verified remediation.
PASS, HOLD, or REVIEW is the decision. Verified remediation is the loop that closes it.
GitHubDependabotTelegraphDeterministic Policy
Repository
facts
facts
Telegraph
route
route
x402
request
request
Policy
threshold
threshold
Decision
PASS / HOLD / REVIEW
PASS / HOLD / REVIEW
Receipt
provenance
provenance
The release threshold
Your CI knows whether the tests passed.
It doesn't know whether the release has enough evidence to proceed.
A scanner can identify a vulnerability. A CVE source can provide vulnerability facts. Neither alone answers whether this specific repository release should proceed.
Limen sits at that threshold.
One decision, distinct roles
Each source answers the question it can actually know.
Repository context, routed CVE evidence and release policy stay visible without becoming one opaque signal.
Telegraph / CVE_LOOKUP
A separately routed signal with provenance, cost, latency and the evidence fields it returned.
limen.yml
The repository declares what blocks a release and what uncertainty must go to human review.
The result is explicit, not implied.
PASSHOLDREVIEW
Real proof
A controlled release crossed the threshold and stopped.
Inspect the public receipt for the full sanitized evidence path.
HOLD / kaelah971/limen-demo
PR #1 · lodash@4.17.20
- Blocking CVE
- CVE-2021-23337
- GitHub severity
- HIGH
- Telegraph severity
- HIGH
- CVSS
- 7.2
- Policy
- HIGH is blocking in runtime scope
- Next action
- Update the dependency to a version that clears all blocking findings under the current policy.
MinerPREFLIGHT Infrastructure Signals
Request$0.01 / 1043 ms
Workflow5 routed lookups
Total$0.05
Demo / backfillRouted CVE lookups5
PASS3
HOLD1
REVIEW1
Three possible states
Not every uncertain release should pass. Not every alert should block.
Evidence supports proceeding under policy.
Continue the release. PASS is not a universal security guarantee.
Repository evidence matches a blocking policy condition.
Stop, patch the dependency or deliberately change the declared policy.
Evidence is incomplete, conflicting, malformed or unavailable.
Investigate the evidence. REVIEW is not a weak PASS.
In the controlled HOLD workflow, GitHub reports HIGH and Telegraph reports CRITICAL for CVE-2026-4800. Limen returns REVIEW rather than silently choosing one source.
How it works
A release check with a visible evidence path.
Pull request opens
The release change establishes the context to evaluate.
Read repository evidence
GitHub and Dependency Review identify the relevant package facts.
Route relevant CVEs
Telegraph receives a paid CVE_LOOKUP request when evidence is needed.
Apply limen.yml
The repository policy compares source-specific evidence against its rules.
Return the state
PASS, HOLD or REVIEW returns to the GitHub workflow.
Leave a decision record
The evidence path becomes durable and may be published as a receipt.
Architecture honesty
The route is useful because the sources stay distinct.
GitHub establishes repository context. Telegraph supplies separately routed CVE evidence. Limen applies release policy.
A Telegraph response alone never proves repository exploitability.Receipt / provenance
The decision should still make sense tomorrow.
Limen can persist the evidence path and publish a sanitized receipt without exposing the private ledger behind it.
LM-REC-B1306724D0B84B6EBDDF7E36Release evidence gate
Let evidence set the threshold.
Controlled demo / Base Sepolia / Telegraph CVE_LOOKUP