Every code quality tool finds issues. The hard part is fixing them without breaking things.
Most tools offer two modes: auto-fix everything, which is dangerous, or just report, which is useless. Truemend takes a different approach — three tiers of remediation, each with a different safety profile. The classification isn't an organizational convenience. It's the safety model.
Tier 1
AST-safe transforms that apply automatically with zero risk — var to const, removing unused imports, deleting a catch block that only rethrows. Every Tier 1 fix is verified by re-parsing the AST after application, automatically reverted if verification fails, and logged with a reversible diff.
In a typical audit, 60–85% of findings are Tier 1. Most of the work happens automatically — and costs nothing.
Tier 2
Known refactoring patterns from a curated catalog — extract function, replace conditional with polymorphism, decompose nested callbacks. The scope is bounded and the output is predictable. Tier 2 refactors land with your team present, each transform reviewed before it merges.
Tier 3
Some issues can't be fixed with a patch or a refactor. A god class needs decomposition. A tangled dependency graph needs untangling. These require architectural decisions that only humans should make. Tier 3 findings come with evidence-backed recommendations — what's wrong, why it matters, what the options are, what we'd suggest. The decision is yours.
Why it matters
By separating fixes by risk level, automated remediation never introduces new bugs, and structural changes always get human oversight. The result: teams ship cleaner code faster, with confidence that the fixes are safe — and a ledger that proves it.