Auto-Fix

Beta

AI-generated PR with the actual fix for a finding. You review, you merge — no scaffolding from you required.

What it does

For any SAST finding with a clear fix pattern (XSS, SQLi, weak crypto, missing input validation), Auto-Fix generates a PR against the same repo with the suggested code change. You review the diff, the tests, and the commit message; if it looks right, merge.

Auto-Fix is in Beta. Quality varies by language + bug class. Use it as a starting point + always review the diff carefully — the AI can introduce subtle bugs while "fixing" the original one.

Supported bug classes

SQL injection (parameterise query)

XSS (add escapeHtml + sanitization)

Path traversal (add base-dir prefix check)

Weak crypto (md5→sha256, math/rand→crypto/rand)

Missing input validation (add type/shape check)

Hardcoded secret (move to env var)

Insecure redirect (allow-list check)

Missing security headers

CORS too permissive

How it works

Click Auto-Fix on a finding.
Sectora reads the surrounding code (whole file ≤ 500 lines, or enclosing function + helpers for larger files).
The AI generates a patch + commit message + test (if applicable).
Sectora creates a branch on your linked repo, commits the patch, opens a PR.
The PR includes: the diff, a description of what changed and why, a back-link to the Sectora finding, and an explicit "verify-fix will re-run after merge" note.
You review, comment, request changes, or merge as normal.
On merge, Sectora's verify-fix re-runs automatically — confirming the bug is gone.

Multi-file changes

Some fixes require changes in multiple files (e.g. moving a hardcoded secret to env requires touching the source + adding to .env.example + updating deployment config). Auto-Fix generates all required changes in one PR.

Limits

Only available on Pro tier and above (cost gate — Auto-Fix uses higher-end models).
Won't modify code in files marked "protected" (Settings → Repo → protected paths).
Won't auto-fix findings flagged High-risk-change (e.g. auth flow changes; you don't want the AI redesigning your auth).
Bug classes outside the supported list emit "Auto-Fix unavailable — manual fix required" with the AI's detailed reasoning instead.

Configuration

Settings → Auto-Fix:

Auto-create — Off (default), On for selected bug classes, or On for all.
Reviewers — auto-request reviewers when PR opens.
Target branch — usually main via feature branch; configurable to your gitflow.
Commit author — defaults to sectora-bot; can override.

What's next

Vulnerability Management — the finding queue Auto-Fix consumes.
AI Integrations — Auto-Fix uses your configured AI provider key.