A finding tells you what is wrong. A fix tells you what to write. An auto-fix merge request does the writing: FlawPilot opens a branch on your repository, commits the change, and raises a merge request with the finding, the reasoning, and how to verify it. You review it like any other MR.
Connect a repositoryIn development. Connect a repository today and you will be among the first to get it when it ships.
Add Content-Security-Policy header
flawpilot/fix-csp-header → main
next.config.ts
headers: [
+ { key: 'Content-Security-Policy',
+ value: "default-src 'self'" },
]Why this change
No Content-Security-Policy header was returned, so the browser applies no restriction on where scripts may load from.
Illustrative. Auto-fix merge requests are still in development.
Not a snippet to copy. FlawPilot pushes a branch to your repository with the change already made, so you review a diff in the tool you already use.
Each merge request carries the finding that prompted it, why it matters, and the check that will confirm it is resolved - so a reviewer who did not run the scan still has the context.
Scoped deliberately small. A focused MR is quick to review and safe to revert; a single branch rewriting twenty findings at once is neither.
The MR runs through the same pipeline, reviewers, and branch protection as any other change. Nothing bypasses the checks you already have.
Four steps, and you stay in control at every one of them. FlawPilot prepares the change; your review decides whether it ships.
Authorize FlawPilot on GitHub, GitLab, or Bitbucket - the same connection that powers source-code scanning, with write scope added so it can push a branch. You choose which repositories it can see, and you can revoke access at any time.
acme/checkout-web
main · Private
acme/marketing-site
main · Public
acme/internal-tools
develop · Private
scopes: contents:write · pull_requests:write
Open your report and choose which findings you want a merge request for. Nothing is opened automatically and nothing is raised in bulk - you decide which changes are worth a review cycle, one at a time.
Code scan findings
2 selectednext.config.ts:41
package.json:28
src/lib/session.ts:73
next.config.ts:52
FlawPilot pushes a branch and raises the MR with the diff, the finding that prompted it, and how to verify the fix. Your pipeline runs, your reviewers are requested, and your branch protection applies - exactly as for a teammate’s work.
Add Content-Security-Policy header
flawpilot/fix-csp-header → main
next.config.ts
headers: [
+ { key: 'Content-Security-Policy',
+ value: "default-src 'self'" },
]Why this change
No Content-Security-Policy header was returned, so the browser applies no restriction on where scripts may load from.
You merge when you are satisfied, not before. Re-run the check afterwards and the finding clears only once the fix is live on your site - an open merge request is never treated as a resolved finding.
Finding resolved
verified by re-scan
Header now present on every response
content-security-policy: default-src 'self'
The finding clears when the fix is live, not when the merge request opens.
Findings with one correct fix arrive as a merge request you can merge. Findings that depend on what your product does arrive as a briefed fix with the reasoning attached. Nothing is left as a bare alert.
| Kind of finding | What you get | Why |
|---|---|---|
| Headers and configuration | A merge request | One correct value, a small diff, no business logic involved. |
| Vulnerable dependencies | A merge request | The bump is mechanical. Your pipeline confirms a major version is safe. |
| Insecure defaults in code | A merge request | The safe value is known and the diff is usually one line. |
| Business-logic and access control | A briefed fix, ready to apply | You know what the app is for. We supply the finding, the reasoning, and the change to make. |
| Infrastructure and DNS | A briefed fix, ready to apply | It lives outside the repository, so it ships as an exact instruction rather than a diff. |
Tools that stop at a severity label leave the hard half to you. Whichever form the answer takes here, the work of researching it is already done.
Writing the fix is rarely the slow part. The delay is everything between a finding appearing in a report and a diff landing in the repository.
| Step | By hand | With auto-fix |
|---|---|---|
| Understand the finding | Read the report, research the fix | Included in the MR |
| Write the change | Find the file, make the edit | Already a diff |
| Open it for review | Branch, commit, raise, assign | Already open |
| Decide | A human approves | A human approves |
The last row is identical on purpose. Everything above it is preparation; the decision stays yours.
Letting anything open a pull request on your repository is a reasonable thing to be careful about. Here is exactly what happens and what does not.
The two are halves of the same job. AI remediation writes the fix: the exact header, config, or code change, explained in plain English on your report. Auto-fix merge requests deliver it: the same change, committed to a branch on your repository and raised as a merge request you review. One is the answer, the other is the delivery.
See AI remediationThe merge request is the last step of a chain that already works. Set the earlier steps up now and there is nothing left to do when this ships.
Source-code scanning is live today: vulnerabilities, hardcoded secrets, and vulnerable dependencies, read straight from your repo. It is also the exact connection auto-fix merge requests will use.
Connect a repositoryAI remediation already writes the change for each finding - the header, the config, the patch. Today you copy it; later the same change arrives as a merge request.
See AI remediationCI/CD scanning already runs on each PR and can fail the build on a regression. Auto-fix merge requests add the fix; this adds the gate.
See CI/CD scanningEarly access
One email when auto-fix merge requests go live. Waitlist members get access before it is announced.
Early members help decide which finding types get a merge request first.
Not shipped yet
Auto-fix merge requests are in development. Connect a repository now for source-code scanning, and you will be ready the day this ships.
Connect a repository
