Fixitry

Inspiration

Developer work is already difficult. Adding security checks on top of it can create another layer of stress. That’s why we built Fixitry: to help developers identify vulnerabilities and safely apply fixes without disrupting their workflow.

What it does

Fixitry scans repositories for potential security flaws, explains the findings, and proposes AI-generated fixes. Developers approve the findings and files to modify, after which Fixitry applies the repair, runs the project’s tests, and performs a verification scan.

How we built it

Fixitry combines multiple security tools:

Trivy for dependencies, secrets, containers, and infrastructure configuration
Semgrep for dangerous source-code patterns
OWASP ZAP for vulnerabilities in running web applications
Convex for job management, events, approvals, and scan results
Factory Droid SDK for generating repair suggestions

The worker runs scans in isolated containers with restricted permissions and networking. Every repair is limited to approved files, checked with Git diffs, tested, and rescanned before it is marked successful.

Challenges we ran into

One challenge was protecting the Factory Droid SDK from malicious repositories that could attempt to inject commands into the repair process. We addressed this by isolating repositories, restricting tool permissions, disabling unnecessary network access, using anonymous Git remotes, limiting file changes, and requiring approval before repairs are applied.

We also had to handle failed tests, duplicate workers claiming the same job, cleanup of temporary repositories, and verification scans that distinguish between resolved and remaining findings.

Accomplishments that we’re proud of

We built a multi-level security-checking system for repositories that uses AI-generated fixes. Each scan is deterministic, project-configured, and verified through testing and follow-up security scans.

Most importantly, Fixitry does not blindly trust AI-generated changes. It treats AI as a repair assistant while deterministic scanners, tests, approval gates, and verification checks provide the safety layer. Through this, developers are given the magnifying glass they need to scan errors and validate them based on their judgement.

What’s Next for Fixitry

We plan to optimize scans with caching and allow users to save repositories for faster repeat analysis. Future versions will include user accounts and organization workspaces so teams can collaborate and share scan results. We also want to add email, Slack, and GitHub notifications, custom security policies, and the ability to select and fix multiple findings in a single approved repair workflow.