Skip to main content

​
Overview

Some vulnerabilities cannot be fixed automatically, but they can still be resolved by a person. Instead of leaving these as a dead-end, Backline creates a Manual Fix remediation that explains why automation could not proceed and gives you clear, step-by-step guidance to resolve the issue yourself.
A Manual Fix remediation is actionable, not failed. Backline could not safely apply the fix automatically, so it hands you the context and the steps instead.
Manual Fix applies to SCA (dependency) and Container Image vulnerabilities that are identified as unsupported for automatic remediation.

​
How a Manual Fix Remediation Looks

A Manual Fix remediation has these characteristics:
  • Mode: Hybrid — resolving it requires your collaboration.
  • Status: Manual Fix.
  • Fixability: Review Needed — Backline cannot apply the fix automatically, so a human should review the guidance before acting. See Fixability.
  • No pull request: Because the fix cannot be automated, no PR is created.
  • Impact: Calculated the same way as any other remediation.
The associated vulnerabilities move to Pending Action and stay open until the fix is verified.

​
Where to Find It

Open the remediation to see its Manual Fix details:
  • Remediation side panel → Overview tab — the summary explaining the automation blocker (why Backline could not remediate automatically).
  • Remediation side panel → Remediation Plan tab — the manual guidance, written as clear steps you can follow.
  • Vulnerability side panel — each affected vulnerability shows a short explanation and a See Remediation Plan button that opens the remediation with the Remediation Plan tab.

​
What the Guidance Explains

The manual guidance is generated for each vulnerability, so the exact steps depend on the specific blocker. It covers:
  • What Backline attempted, when applicable.
  • Why automatic remediation cannot continue (the blocker).
  • Which package, dependency, image, Dockerfile, or base image is involved.
  • The manual steps to resolve the issue.
  • How Backline will verify the fix.
Example. Backline cannot safely upgrade a transitive package that is pinned in place by an npm override policy, because changing that override could affect the rest of your dependency tree. The remediation explains the blocker and offers safe manual paths, such as upgrading the parent package to a version that already depends on a patched release.

​
Grouping

To avoid duplicate work, Backline groups related vulnerabilities into a single Manual Fix remediation (one per CVE by default):
  • SCA — vulnerabilities in the same repository that share the same vulnerable package.
  • Container Image — vulnerabilities that share the same base image version and the same Dockerfile, when known.

​
Verification

You do not need to close a Manual Fix remediation manually. After you apply the fix, Backline verifies it automatically on the next scanner ingestion. When the vulnerable package or image is no longer reported at a vulnerable version, all linked vulnerabilities move to Resolved.
1

Review the blocker

Open the remediation and read the summary in the Overview tab to understand why automation could not proceed.
2

Follow the guidance

Open the Remediation Plan tab and apply the recommended manual steps.
3

Let Backline verify

On the next scan, Backline confirms the fix and moves the vulnerabilities to Resolved automatically.

Remediations Overview

Understand how remediations work in Backline

Fixability

Learn what the Review Needed badge means

Remediation Summary

See how Backline explains what a remediation changed

Vulnerabilities Overview

Understand vulnerability statuses, including Pending Action