# AutoFix for Pentest and AI Code Analysis

AutoFix writes code fixes for security issues found by Aikido Pentest, AI Code Analysis, and Deep Review, and delivers them as pull requests (PRs). All programming languages are supported.

You can get a fix in 3 ways:

* **From the AutoFix page:** preview a fix, refine it, and open a PR when you're ready.
* **Automatically:** Aikido opens a PR as soon as a pentest reports a finding that matches your policy.
* **From a pull request comment:** reply to a Deep Review finding, and Aikido opens a fix PR on top of your PR.

## Prerequisites

* [AutoFix](https://help.aikidogov.us/autofix-and-remediation/overview-aikido-autofix) is set up with write access to the repository.
* The finding points to a source code file in a connected repository. Findings without a file location, such as a misconfigured web server header, can't be fixed with code.

## How it works

Aikido Pentest and AI Code Analysis produce a root-cause analysis for each finding. AutoFix uses that analysis to change the code that causes the issue, not only the endpoint where it was observed.

| | AutoFix page | Automated PRs | Pull request comment |
| --- | --- | --- | --- |
| **Findings** | Aikido Pentest and AI Code Analysis | Aikido Pentest and AI Code Analysis | Deep Review |
| **Trigger** | You click **Create Preview** or **Create PR** | A new finding matches your severity policy | You reply to the finding comment |
| **Base branch** | Default branch, or a branch you pick | Default branch, or the branch of the preview | The branch of the PR you're reviewing |
| **Where you review** | Preview in the Aikido app, then the PR | The PR | The PR |

## Fix findings from the AutoFix page

{% stepper %}
{% step %}
### Open the findings

Go to [**AutoFix** → **Code**](https://app.aikido.dev/issues/fix/pentest) and select **Pentests** or **AI Code Analysis**. Narrow the list with the **Repo**, **Severity**, and **Pentest Project** filters.

<figure><img src="https://help.aikidogov.us/_assets/50a1e9f1cb07/image-442.png" alt="AutoFix page with the Pentests tab open, listing findings by severity and repository"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
### Preview the fix

Click **Create Preview** on a finding. For critical and high severity findings, Aikido often prepares the preview as soon as the pentest reports them, so you can click **View Preview** right away.

<figure><img src="https://help.aikidogov.us/_assets/a3a317cbb1d3/image-443.png" alt="AutoFix preview showing the code changes that fix a pentest finding"><figcaption></figcaption></figure>

The preview shows extra information when it's available:

* **Outdated:** the files changed after the preview was made. Click the label to regenerate the preview against the latest code.
* **Tests Passed** or **Tests Failed:** the result of running your tests against the fix.
{% endstep %}

{% step %}
### Adjust the fix

If the fix isn't quite right, click **Refine with Aikido AI** and describe what to change. See [Refine AutoFixes with Aikido AI](https://help.aikidogov.us/autofix-and-remediation/automation-and-merging/refine-autofixes-with-aikido-ai). Click **Regenerate** to start over, or **Mark as Ignored** if the finding doesn't need a fix.
{% endstep %}

{% step %}
### Open the pull request

Click **Create PR**. The dropdown next to it has more options:

* **Create PR to Specific Branch:** open the PR against a branch other than the default branch, for example a release branch.
* **Create PR and Ship it:** open the PR and add your repository's deploy label to it.
{% endstep %}
{% endstepper %}

## Create fixes automatically

AutoFix can open a PR for each new pentest or AI Code Analysis finding without anyone clicking a button. Unlike the daily automated PRs for dependencies and static application security testing (SAST), these PRs are created as soon as the finding is reported.

For each new finding, Aikido:

1. Generates a fix preview.
2. Checks the finding against your repository and severity settings.
3. Opens a PR if the preview contains a code change and the finding matches.

### Set up automated PRs

{% stepper %}
{% step %}
### Open the automated PR settings

Go to [**AutoFix** → **Settings**](https://app.aikido.dev/issues/fix/settings) and scroll to **Automated PRs**.
{% endstep %}

{% step %}
### Turn on fixes for pentest and AI Code Analysis issues

Turn on **Automatically fix Pentest & AI Code Analysis issues**.

<figure><img src="https://help.aikidogov.us/_assets/1befee1fc87e/autofix-pentest-automated-prs-settings.png" alt="Manage Pentest and AI Code Analysis Autocreation modal with the repository and severity settings"><figcaption></figcaption></figure>
{% endstep %}

{% step %}
### Choose repositories and severity

* **Repositories:** select all repositories or a subset.
* **Severity levels:** select **Critical and High severity** to fix the issues that matter most, or **All issues**.
* **Only private repos** (under advanced settings): never open automated PRs on public repositories.
{% endstep %}

{% step %}
### Save the settings

Click **Save Settings**. The **Automated PRs** section now shows **Pentest & AI Code Analysis Issues** with the severity you selected.
{% endstep %}
{% endstepper %}

{% hint style="info" %}
Automated PRs follow your [PR configuration](https://help.aikidogov.us/autofix-and-remediation/configure/autofix-pr-configuration), such as title prefixes, branch names, and labels.
{% endhint %}

### Override the settings per repository

Add an `.aikido` file to the root of a repository's default branch to change the severity policy for that repository only. The value in the file takes priority over the **Severity levels** setting in the Aikido app. Automated PRs must still be turned on and the repository must still be selected in the Aikido app.

{% code title=".aikido" %}
```yaml
autofix:
  automated:
    pentest:
      update_policy: all # or critical_and_high_only
```
{% endcode %}

To stop automated pentest PRs for a repository, set `disabled: true` instead:

{% code title=".aikido" %}
```yaml
autofix:
  automated:
    pentest:
      disabled: true
```
{% endcode %}

See [Repository-specific configuration](https://help.aikidogov.us/autofix-and-remediation/configure/autofix-pr-configuration#repository-specific-configuration) for all `.aikido` options.

### Manage the settings with the API

Read and update the same settings with the public API. Reading requires the `autofix:read` scope, and updating requires `autofix:write`.

* [Get Pentest AutoFix PR creation settings](https://apidocs.aikido.dev/reference/getpentestautofixsettings): `GET /api/public/v1/repositories/autofix/pentest/settings`
* [Update Pentest AutoFix PR creation settings](https://apidocs.aikido.dev/reference/updatepentestautofixsettings): `PUT /api/public/v1/repositories/autofix/pentest/settings`

{% code title="Request body" %}
```json
{
  "enabled": true,
  "severity_filter": "critical_and_high_only",
  "repos_scope": "selected",
  "repo_ids": [123, 456]
}
```
{% endcode %}

`severity_filter` accepts `all` or `critical_and_high_only`. `repos_scope` accepts `all` or `selected`, and defaults to `all`. Send `{"enabled": false}` to turn automated PRs off. The **Only private repos** option is only available in the Aikido app.

## Fix Deep Review findings from a pull request comment

When [Deep Review](https://help.aikidogov.us/deep-review/how-deep-review-works) posts a finding on your PR, you can get a fix without leaving the PR. Reply to the finding comment and ask for a fix in plain language. You don't need a command or a tag.

<figure><img src="https://help.aikidogov.us/_assets/e185f82f88bb/autofix-deep-review-reply-fix.png" alt="Reply on a Deep Review finding comment asking Aikido to fix the issue, with Aikido's reply linking to the fix pull request"><figcaption></figcaption></figure>

Aikido reads your reply and works out what you want. If you ask for a fix, Aikido:

1. Writes a fix for the finding, starting from the latest commit on your PR.
2. Opens a new PR that targets **your PR's branch**, not the default branch. Merge it to bring the fix into your PR.
3. Replies to your comment with a link: "Opened a new pull request to fix the issue: #123. The new pull request is based on the current PR."

The fix PR describes the change and links back to the Deep Review finding.

### Add context to your request

Aikido gives your whole reply to AutoFix as instructions. Use it to steer the fix:

* "Can you fix this?"
* "Fix this, but use the `sanitizeHtml` helper we already have in `utils/`."
* "Please fix it and keep the existing error response format."

Aikido only opens a fix PR when you clearly ask for one. A reply like "I'll fix this myself" doesn't trigger a fix.

### What happens to the fix pull request

Aikido closes the fix PR for you when it's no longer needed:

* **The finding is resolved or ignored:** Aikido closes the fix PR.
* **Your PR is merged or closed:** Aikido closes the fix PRs that are still open for it.

### Limitations

Fix requests from pull request comments are available for GitHub, GitHub Enterprise Server, GitLab Cloud, and GitLab Self-Managed. Support for Bitbucket and Azure DevOps is coming soon.

{% hint style="info" %}
To let only members of your Aikido workspace trigger fixes from comments, turn on **Restrict @AikidoSec commands to Aikido users** in your [PR check settings](https://help.aikidogov.us/pr-and-release-gating/aikido-ci-gating-functionality#advanced-configuration).
{% endhint %}

## What happens after a fix is merged

When all issues linked to an AutoFix PR are resolved, for example because the fix was merged through another PR, Aikido closes the PR and deletes its branch. If someone else has pushed commits to the PR, Aikido leaves it open.

## Language support

AutoFix works with all programming languages. For JavaScript codebases, it also writes new unit tests and updates existing ones. It applies linting rules to the generated code for JavaScript, Python, and .NET.

## FAQ

<details>

<summary>Why is there no fix for a pentest finding?</summary>

AutoFix only changes source code, so it needs a finding that points to a file in a connected repository. Findings from pentests that don't have access to your code have no file location. A finding about server or cloud configuration also can't be fixed in code.

</details>

<details>

<summary>Why didn't Aikido open an automated PR?</summary>

Check that the repository is selected in the automated PR settings, the finding's severity matches your policy, and the repository's `.aikido` file doesn't disable pentest fixes. If **Only private repos** is on, public repositories are skipped. Aikido also skips automated PRs while your wallet has a negative balance.

</details>

<details>

<summary>Why didn't Aikido respond to my fix request on a pull request?</summary>

Make sure you replied in the thread of the Deep Review finding comment, not in a new comment on the PR. Check that your repository is on GitHub, GitHub Enterprise Server, GitLab Cloud, or GitLab Self-Managed. If **Restrict @AikidoSec commands to Aikido users** is on, your SCM account must be linked to a member of the Aikido workspace.

</details>

## Related

{% content-ref url="../automation-and-merging/automatic-creation-of-pull-requests.md" %}
[automatic-creation-of-pull-requests.md](https://help.aikidogov.us/autofix-and-remediation/automation-and-merging/automatic-creation-of-pull-requests)
{% endcontent-ref %}

{% content-ref url="../automation-and-merging/refine-autofixes-with-aikido-ai.md" %}
[refine-autofixes-with-aikido-ai.md](https://help.aikidogov.us/autofix-and-remediation/automation-and-merging/refine-autofixes-with-aikido-ai)
{% endcontent-ref %}

{% content-ref url="../configure/autofix-pr-configuration.md" %}
[autofix-pr-configuration.md](https://help.aikidogov.us/autofix-and-remediation/configure/autofix-pr-configuration)
{% endcontent-ref %}

{% content-ref url="../../deep-review/how-deep-review-works.md" %}
[how-deep-review-works.md](https://help.aikidogov.us/deep-review/how-deep-review-works)
{% endcontent-ref %}