How River takes security work from a fix to merge

Our short summary of Shopify’s engineering write-up. The full story, with all the detail, is on their blog.

Problem

Security teams struggled with slow, manual patch handling and a growing backlog of vulnerability fixes.

They built River, an AI agent in Slack that automates checking, updating, and merging patches, and routes decisions to engineers when needed.

Backlog down 70%, merge rate rose to 80%

Want the architecture, code and numbers? They’re in the original post.