Drafts only, each with its source. Nothing is changed.
Drop your scan file. The page reads it in your browser. Each finding gets a draft fix when we can write one, with its source.
Your file is not uploaded. The page reads it here, in your browser. After it runs, the page sends us one short line. It says which scanner made the file, how many findings it had, and how many we could draft for. Nothing else. Not the file, not a finding, not your name.
Accepted: Trivy JSON (its secret findings too) · Grype JSON · ZAP JSON/XML · SARIF JSON · Snyk JSON · OSV-Scanner JSON · npm audit JSON · pip-audit JSON · Nuclei JSON/JSONL · Gitleaks JSON · Semgrep JSON · Checkov JSON · Burp XML · Qualys XML · Nessus XML. Files up to 25 MB and 20,000 findings.
Real Trivy scan of the public nginx:1.19.10 image. Fields the page does not read were removed to fit the page.
0 of 0 findings have a draft fix · 0 match a known fix pattern · 0 not assessed
These drafts come from your scan and our fix rules. We have not tested them on your code.
This file has findings, but we could not draft a fix for any of them. That is a real result, not an error.
We draft these from our fix rules. Each step names its source.
| Finding | Weakness | Fix |
|---|
A secret found in your files gets a rotation plan, not a code change. Turn the old one off where it was issued. Put a new one in place. Check the provider's log for use of the old one.
| Finding | Weakness | Fix |
|---|
We draft these from the two versions in your scan. The fixed version is the one your scanner reported.
| Finding | Weakness | Fix |
|---|
We have a fix pattern for this kind of weakness. Drafting it for your code happens inside the product, with your approval.
| Finding | Weakness | Fix |
|---|
No draft for these. The scan gives us no weakness we can act on, or the fix is not a code change.
| Finding | Weakness | Fix |
|---|
Want the full run? We run it for you: fix steps for every finding, each with its source. Ask, and we send a private, one-time report link.