Protecting a Repository

Aikido Libraries is currently in limited availability and is enabled per workspace by Aikido. If you don't see it in your account and would like access, reach out via the in-app chat.

Protection is the action that turns Aikido Libraries on for a single repository. Each repository is protected independently, so you can roll the feature out gradually starting with the codebases where dependency upgrades are hardest.

Protect a repository

Step 1: Open AutoFix > Aikido Libraries and select the Protected Repos tab. The tab lists every repository in your workspace with its current protection status.

Step 2: Find the repository you want to protect and click Protect Repo in the Status column.

Step 3: In the Enable Aikido Library Protection modal, review the credit breakdown. The modal shows the package count, the open CVE count Aikido detected in that repository, the resulting credit cost as Total (1 Year) (protection is sold as a 1-year subscription per repository), and your available credit balance. If your balance is below the total, click Add Credits in the modal to top up before confirming.

Step 4: Click Protect Repo to confirm. Aikido deducts the credits from your wallet and immediately takes the repository's CVE inventory so Aikido-pinned variants can be produced.

After protection is enabled, Aikido produces a daily PR that updates the manifest and lock files to the Aikido-pinned variants of your packages. The PR follows the same configuration as other AutoFix PRs, so titles, labels, and branch names are governed by your existing AutoFix PR Configuration.

Pricing and credits

Aikido Libraries is sold as a 1-year subscription per protected repository, paid with Aikido credits. The cost of protecting a single repository for one year is calculated as:

cost (credits) = max(2000,  1 × (packages in repo) + 50 × (open CVEs in repo))

1 credit equals $1. Protection has a $2,000 floor per repository per year, so smaller repositories enroll at the minimum even if the formula produces a lower number.

How the count is determined

• Packages is the total number of packages resolved across the repository's manifest and lock files at the time protection is enabled. Two different versions of the same package count as two packages, because each version is patched separately. The per-package fee covers ongoing protection of each package for the full subscription year, including CVEs discovered later in the year.
• Open CVEs is the size of the current open-CVE backlog Aikido reports against those packages at the time protection is enabled. The per-CVE fee covers the one-time work of clearing that existing backlog.

Example

A repository with 121 packages and 12 open CVEs:

1 × 121 + 50 × 12 = 121 + 600 = 721 credits
→ below the $2,000 floor, charged 2,000 credits  (Total, 1 Year)

A larger repository with 3,500 packages and 40 open CVEs:

1 × 3,500 + 50 × 40 = 3,500 + 2,000 = 5,500 credits  (Total, 1 Year)

Renewal

Protection renews automatically each year at the cost recalculated against the repository's package and CVE counts at the time of renewal. The $2,000 floor applies on renewal as well. To stop renewal, see Cancel Renewal below.

What gets sent to Aikido

When a repository is protected, Aikido sends the following per-package information so our pinned variants can be produced and matched:

• CVE identifier
• Package name
• Package version

No source code from your repository is sent. Aikido operates on the open-source package contents, not on your application code.