AutoFix for Pentest and AI Code Analysis

AutoFix writes code fixes for security issues found by Aikido Pentest, AI Code Analysis, and Deep Review, and delivers them as pull requests (PRs). All programming languages are supported.

You can get a fix in 3 ways:

• From the AutoFix page: preview a fix, refine it, and open a PR when you're ready.
• Automatically: Aikido opens a PR as soon as a pentest reports a finding that matches your policy.
• From a pull request comment: reply to a Deep Review finding, and Aikido opens a fix PR on top of your PR.

Prerequisites

• AutoFix is set up with write access to the repository.
• The finding points to a source code file in a connected repository. Findings without a file location, such as a misconfigured web server header, can't be fixed with code.

How it works

Aikido Pentest and AI Code Analysis produce a root-cause analysis for each finding. AutoFix uses that analysis to change the code that causes the issue, not only the endpoint where it was observed.

Fix findings from the AutoFix page

1. 1

   Open the findings

   Go to AutoFix → Code and select Pentests or AI Code Analysis. Narrow the list with the Repo, Severity, and Pentest Project filters.

   

2. 2

   Preview the fix

   Click Create Preview on a finding. For critical and high severity findings, Aikido often prepares the preview as soon as the pentest reports them, so you can click View Preview right away.

   

   The preview shows extra information when it's available:

   • Outdated: the files changed after the preview was made. Click the label to regenerate the preview against the latest code.
   • Tests Passed or Tests Failed: the result of running your tests against the fix.
3. 3

   Adjust the fix

   If the fix isn't quite right, click Refine with Aikido AI and describe what to change. See Refine AutoFixes with Aikido AI. Click Regenerate to start over, or Mark as Ignored if the finding doesn't need a fix.

4. 4

   Open the pull request

   Click Create PR. The dropdown next to it has more options:

   • Create PR to Specific Branch: open the PR against a branch other than the default branch, for example a release branch.
   • Create PR and Ship it: open the PR and add your repository's deploy label to it.

Create fixes automatically

AutoFix can open a PR for each new pentest or AI Code Analysis finding without anyone clicking a button. Unlike the daily automated PRs for dependencies and static application security testing (SAST), these PRs are created as soon as the finding is reported.

For each new finding, Aikido:

1. Generates a fix preview.
2. Checks the finding against your repository and severity settings.
3. Opens a PR if the preview contains a code change and the finding matches.

Set up automated PRs

1. 1

   Open the automated PR settings

   Go to AutoFix → Settings and scroll to Automated PRs.

2. 2

   Turn on fixes for pentest and AI Code Analysis issues

   Turn on Automatically fix Pentest & AI Code Analysis issues.

   

3. 3

   Choose repositories and severity

   • Repositories: select all repositories or a subset.
   • Severity levels: select Critical and High severity to fix the issues that matter most, or All issues.
   • Only private repos (under advanced settings): never open automated PRs on public repositories.
4. 4

   Save the settings

   Click Save Settings. The Automated PRs section now shows Pentest & AI Code Analysis Issues with the severity you selected.

Override the settings per repository

Add an .aikido file to the root of a repository's default branch to change the severity policy for that repository only. The value in the file takes priority over the Severity levels setting in the Aikido app. Automated PRs must still be turned on and the repository must still be selected in the Aikido app.

autofix:
  automated:
    pentest:
      update_policy: all # or critical_and_high_only

To stop automated pentest PRs for a repository, set disabled: true instead:

autofix:
  automated:
    pentest:
      disabled: true

See Repository-specific configuration for all .aikido options.

Manage the settings with the API

Read and update the same settings with the public API. Reading requires the autofix:read scope, and updating requires autofix:write.

• Get Pentest AutoFix PR creation settings: GET /api/public/v1/repositories/autofix/pentest/settings
• Update Pentest AutoFix PR creation settings: PUT /api/public/v1/repositories/autofix/pentest/settings

{
  "enabled": true,
  "severity_filter": "critical_and_high_only",
  "repos_scope": "selected",
  "repo_ids": [123, 456]
}

severity_filter accepts all or critical_and_high_only. repos_scope accepts all or selected, and defaults to all. Send {"enabled": false} to turn automated PRs off. The Only private repos option is only available in the Aikido app.

Fix Deep Review findings from a pull request comment

When Deep Review posts a finding on your PR, you can get a fix without leaving the PR. Reply to the finding comment and ask for a fix in plain language. You don't need a command or a tag.

Aikido reads your reply and works out what you want. If you ask for a fix, Aikido:

1. Writes a fix for the finding, starting from the latest commit on your PR.
2. Opens a new PR that targets your PR's branch, not the default branch. Merge it to bring the fix into your PR.
3. Replies to your comment with a link: "Opened a new pull request to fix the issue: #123. The new pull request is based on the current PR."

The fix PR describes the change and links back to the Deep Review finding.

Add context to your request

Aikido gives your whole reply to AutoFix as instructions. Use it to steer the fix:

• "Can you fix this?"
• "Fix this, but use the sanitizeHtml helper we already have in utils/."
• "Please fix it and keep the existing error response format."

Aikido only opens a fix PR when you clearly ask for one. A reply like "I'll fix this myself" doesn't trigger a fix.

What happens to the fix pull request

Aikido closes the fix PR for you when it's no longer needed:

• The finding is resolved or ignored: Aikido closes the fix PR.
• Your PR is merged or closed: Aikido closes the fix PRs that are still open for it.

Limitations

Fix requests from pull request comments are available for GitHub, GitHub Enterprise Server, GitLab Cloud, and GitLab Self-Managed. Support for Bitbucket and Azure DevOps is coming soon.

What happens after a fix is merged

When all issues linked to an AutoFix PR are resolved, for example because the fix was merged through another PR, Aikido closes the PR and deletes its branch. If someone else has pushed commits to the PR, Aikido leaves it open.

Language support

AutoFix works with all programming languages. For JavaScript codebases, it also writes new unit tests and updates existing ones. It applies linting rules to the generated code for JavaScript, Python, and .NET.

FAQ

Related