Create your first remediation

Using the onboarding wizard you can create your first remediation in a matter of seconds.

Before you begin

To get started quickly with BIMP, you need:

• Permission to install the BIMP GitHub App into your GitHub organization or configure the GitLab group connection.
• Access to at least one suitable repository. A suitable repository should include at least one Dockerfile, Compose file, devcontainer definition, or Helm values file.

1. Create the organization

If this is your first time using BIMP, you are directed to the onboarding wizard.

Start by entering your organization name. You can change it later.

2. Create your first team

Enter the team that will own the first repository. Teams are the way BIMP organizes routines and reporting. You can edit this team and add more teams later.

3. Schedule a routine

Choose how often BIMP should open routine pull or merge requests for the team. This should align with the team’s current working practices to ensure the BIMP updates arrive at the right moment for the team to act on the change.

4. Connect GitHub or GitLab

GitHub: When you select GitHub, BIMP asks you to sign in, select the GitHub organization, and choose the repositories you want to connect. BIMP uses a GitHub App to secure this connection.

GitLab: You will need to generate a group access token for your group before BIMP can connect via the GitLab API. You will need to enter the group path, group access token, and webhook signing token. BIMP validates the token before saving the connection.

Before connecting either provider, review Integration Permissions for the exact access BIMP requests and the provider-side revocation steps.

5. Select repositories and branches

Choose one or more repositories and select the branches you want to scan. Your selection should include at least one Dockerfile, Compose file, devcontainer definition, or Helm values file.

BIMP scans the selected branches and reveals the base images as they are discovered. This should take less than one minute but could take longer if you have connected a large number of repositories.

6. Create a simple image mapping

An image mapping tells BIMP which image needs to be replaced and what to replace it with. Choose an observed From image and enter the To image your organization approves.

python:3.9-alpine -> python:3.14.6-alpine

Note that you can also use wildcard mappings in the From image. This allows you to apply a mapping to multiple base images in one action.

python:3* -> python:3.14.6-alpine

If you are not sure what image to use, BIMP can populate it for you with the built-in Docker Official Image recommendations. In this dialog, BIMP gives you the option to pin to a digest or use a floating tag. Organizations that are in control of their software supply chain typically pin to a specific digest.

7. Review and remediate

You are prompted to review the change impact. This shows you a list of the repositories, branches, and artifacts that would be affected immediately if you publish the mappings. Select Publish and remediate to create the remediation pull or merge request.

8. Merge the fix

You can now review the change following your existing processes for build, test, and deployment.