A second reviewer for every pull request.

What is measured, and what is not

Fixor runs on Node/TypeScript. Four of the six detectors send every candidate to Claude; the admin-check detector does the same except for three literal patterns; the secrets check matches sixteen fixed credential shapes and never calls a model. The numbers below are the secrets check's: counts with their denominators, no rate.

Customer-shaped means public TypeScript and JavaScript repositories of the size and age of a typical customer, a sample and not a census; mature open source means 13 established projects that do not commit real secrets. Every flag was read blind by three readers, and the three real keys sat in one repository. Measured 2026-09-12 on the version that ships.

Paths not read

Files under test, e2e, spec, script or fixture paths, and Go test files, are not read, so a credential committed there is not seen. That rule removed 50 flags across the two corpora above; none of the 50 was a real credential.

Shape coverage

Of the 208 rules in the gitleaks 8.24.3 default set: 5 covered outright, 2 in part, 201 not covered. 7 Fixor shapes have no rule in that set: three credential formats, four exposure contexts.

Fixtures

16 of 16 authored positive fixtures flagged; 0 of 19 authored negatives flagged.

Not measured. The other five detectors (auth bypass, missing admin gates, IDOR, environment-variable exposure, unverified webhooks) are measured on authored fixtures only; their real-code numbers will appear here as each is measured, and nothing about them is claimed until then.

Every number above is a count with its denominator, never a rate. The artifacts behind each figure are in the public repository under docs/measurements/.

How it works

Three steps from push to a security report—right in the thread your team already uses.

What lands on your PR

A clean, structured security report — right where your team already reviews code. Every finding comes with an explanation and remediation steps. Not a replacement for human review.

## 🛡️ Fixor Security Report

**Repository:** `acme/payments-api` · **PR:** #42
**Commit:** `a1b2c3d4e5f6...`

### Summary

| | |
|-|-|
| **Workflow status** | ✅ `success` |
| **Findings** | 5 |
| **Detection confidence** | high: 4 · pattern match: 1 |

### Findings

▸ 1. `src/routes/admin.ts:25` · `AUTH_BYPASS` · **high**
▸ 2. `src/routes/orders.ts:9` · `IDOR` · **high**
▸ 3. `src/routes/users.ts:12` · `ADMIN_CHECK` · **high**
▸ 4. `src/routes/debug.ts:7` · `ENV_EXPOSURE` · **high**
▸ 5. `src/config/payments.ts:4` · `SECRETS_EXPOSURE` · **pattern match**

---

### 📄 Download full report

**Download PDF Report →**

_Report suitable for sharing with your team._

🔒 Analyzed by Fixor · 2026-04-19T00:03:31Z

What ships with every scan

A report on the PR, a PDF of it, and a GitHub App to install it.

Pricing

Start free, upgrade when you outgrow the budget. Paddle is our merchant of record — they handle VAT and the cancel / update-payment portal.