Security checks on every pull request.

What is measured, and what is not

Fixor runs on Node/TypeScript. Four of the six detectors send every candidate to Claude; the admin-check detector does the same except for three literal patterns; the secrets check matches sixteen fixed credential shapes and never calls a model. The numbers below are the secrets check's: counts with their denominators, no rate.

Customer-shaped means public TypeScript and JavaScript repositories of the size and age of a typical customer, a sample and not a census; mature open source means 13 established projects that do not commit real secrets. Every flag was read blind by three readers, and the three real keys sat in one repository. Measured 2026-09-12 on the version that ships.

Paths not read

Files under test, e2e, spec, script or fixture paths, and Go test files, are not read, so a credential committed there is not seen. That rule removed 50 flags across the two corpora above; none of the 50 was a real credential.

Shape coverage

Of the 208 rules in the gitleaks 8.24.3 default set: 5 covered outright, 2 in part, 201 not covered. 7 Fixor shapes have no rule in that set: three credential formats, four exposure contexts.

Fixtures

16 of 16 authored positive fixtures flagged; 0 of 19 authored negatives flagged.

The other five detectors. Each passes its authored fixtures. On real code, the three access-control detectors (auth bypass, missing admin gates, IDOR) were tested once: on 12 published access-control vulnerabilities in real open-source projects, the shipped pipeline flagged none (field trial, 2026-09-19). Environment-variable exposure and unverified webhooks have no real-code result. Detection development stopped on 2026-10-04; these detectors ship as they are, and no detection claim is made for them here.

Every number above is a count with its denominator, never a rate. The artifacts behind each figure are in the public repository under docs/measurements/.

How it works

Three steps from push to a security report—right in the thread your team already uses.

What lands on your PR

A clean, structured security report — right where your team already reviews code. Every finding comes with an explanation and remediation steps. Not a replacement for human review.

## 🛡️ Fixor Security Report

**Repository:** `acme/payments-api` · **PR:** #42
**Commit:** `a1b2c3d4e5f6...`

### Summary

| | |
|-|-|
| **Workflow status** | ✅ `success` |
| **Findings** | 5 |
| **Detection confidence** | high: 4 · pattern match: 1 |

### Findings

▸ 1. `src/routes/admin.ts:25` · `AUTH_BYPASS` · **high**
▸ 2. `src/routes/orders.ts:9` · `IDOR` · **high**
▸ 3. `src/routes/users.ts:12` · `ADMIN_CHECK` · **high**
▸ 4. `src/routes/debug.ts:7` · `ENV_EXPOSURE` · **high**
▸ 5. `src/config/payments.ts:4` · `SECRETS_EXPOSURE` · **pattern match**

---

### 📄 Download full report

**Download PDF Report →**

_Report suitable for sharing with your team._

🔒 Analyzed by Fixor · 2026-04-19T00:03:31Z

What ships with every scan

A report on the PR, a PDF of it, and a GitHub App to install it.

Pricing

Not on offer while the GitHub App is private; the plans below are what the billing code implements. The cap is the only limit: Fixor does not count scans or restrict repositories, and a cap of $0 pauses scanning. Prices and caps are current values and may change. Paddle is our merchant of record — they handle VAT and the cancel / update-payment portal.