From finding to draft pull request.
The scanner does not need a model to find your problem. You might want one to fix it - so that is exactly where the model is used, with the price shown before it runs.
Written against your file.
The patch is generated from the file in your repository - its imports, its helpers, its conventions - and opened as a draft pull request on a branch of its own. A person reads it, runs it and merges it. Nothing is pushed to your default branch.
- Draft by default
It arrives as a draft, because a machine-written change deserves a review.
- Scoped
One finding, or a group that shares a root cause. Not an unrelated refactor.
- Explained
The pull request body says what was wrong and why the change fixes it.
- Verified next scan
The rule that raised the finding re-runs on the merge and resolves it.
export async function GET(req: Request) {
+ const session = await requireSession(req);
+ if (!session) return unauthorized();
- const orders = await db.$queryRawUnsafe(`SELECT * FROM orders WHERE status = '${status}'`);
+ const orders = await db.order.findMany({
+ where: { status, organizationId: session.orgId },
+ });
return Response.json(orders);
}
11 tasks. Nothing else.
This is the full list. Detection is not on it, because detection is deterministic.
Sorting a detection into a bucket.
What it means in your application, not in the abstract.
Who is allowed to call this route, judged from the code.
One route, one question, answered from the facts on the page.
A guide to the site for language models, written from the pages the scan read.
One code improvement, every copy in hand: refactor it, leave it, or decide first.
A plan for the change, written against your file.
The file rewritten and opened as a draft pull request.
A risky push read by a model, over the changed files only.
A second, better model re-judges anything critical.
The whole application read at once, on the premium tier.
Six rules between a model and your bill.
An AI feature that cannot be budgeted is a liability, not a feature. These are the controls the gateway applies to every single call.
- Estimated before it runs
Each task has a worst-case input and output budget and a per-call money cap. The estimate is reserved from your credits before the first token is generated.
- Routed by difficulty
A classification goes to the cheap model. An explanation of a low-severity finding does too. A critical judgement is escalated to a better one - that is the whole rule.
- Refunded when it fails
A task that errors or returns nothing usable releases its reservation. You are never charged for an answer you did not get.
- Capped per site and per organization
A hard money ceiling stops a runaway regardless of credits, and a reserve is held back so a critical finding can always be escalated.
- Never on dismissed work
A finding you marked as accepted risk or false positive does not get explained, judged or fixed again.
- Never in the background
There is no ambient AI pass. Every task on your bill was started by a person clicking something.
- FreeClassify a signalSorting a detection into a bucket. The cheap model has never lost this one.
- 8Explain a findingWhat it means in your application, not in the abstract.
- 14Authorization analysisWho is allowed to call this route, judged from the code.
- 9Ask about a routeOne route, one question, answered from the facts on the page.
- 11Write llms.txtA guide to the site for language models, written from the pages the scan read.
- 16Fix with AIA plan for the change, written against your file.
- 58Fix as a draft pull requestThe file rewritten and opened as a draft pull request.
- 22Verify a changeA risky push read by a model, over the changed files only.
- 47Critical escalationA second, better model re-judges anything critical.
- 80Deep reviewThe whole application read at once, on the premium tier.
Once in a while, read the whole thing.
A deep review takes the facts the scans established - stack, routes, guards, tenancy, data, dependencies - and judges the application as a whole on the premium tier. It costs 80 credits, it is paid for once, and it is kept afterwards so you can read it again without paying twice.
Try it on a finding you already have.
Run the free scan first. If something comes back, connect the repository and let it open the fix as a pull request.