v0.1.0 — first public release

First public release of virtual-patch-copilot — an agentic AppSec copilot that finds
application vulnerabilities, mitigates each live with the right F5 Distributed Cloud (XC)
control, and drafts the real code fix — collapsing the window between "AI found a vuln" and "the
fix ships" from weeks to minutes, with a human in the loop and everything reversible.

Highlights

• Find → mitigate live → cure → retire. discover → verify → triage → generate the XC band-aid
  → apply it behind a human gate → open the code-fix PR (the cure) → retire the band-aid when the
  cure merges. A ledger tracks every finding through those four states.
• It validates its own work. Each band-aid is fired against the finding's real exploit and
  refined until it actually blocks (before 200 → after 403 BLOCKED), or reported honestly as
  "unfixable — ship the code fix." It never claims a fix that doesn't work.
• Safety spine. Every live change: snapshot → idempotent self-test → attach → validate →
  keep or verified rollback; protected-LB / protected-policy guardrails throughout.
• Model-independent. Every agent's model is set per-agent in config/agents.yaml — Claude,
  OpenAI, Gemini, or local Ollama, no code change.
• Guided console. A five-step flow — Scan → Review → Mitigate → Cure → Retire — with a live
  hero band and a shareable HTML report.
• Safe on-ramp. Try it on known-vulnerable OSS apps (VAmPI / OWASP crAPI) with a scan that
  makes no changes — see docs/TRY_IT.md. A fully-worked offline sample lives in demo/out.

Under the hood

One SafeApply engine + a controls registry behind seven XC control families (service_policy,
waf, waf_data_guard, api_schema, rate_limit, malicious_user, bot_defense). 109 tests (all offline
against fakes), ruff + coverage-gated CI across Python 3.10–3.12.

Apache-2.0. Not affiliated with or endorsed by F5, Inc.

Start here: README ·
docs/TRY_IT.md