● Proof of Concept · in active development

Find security risks. Get the fix.

VulnFix is an AI-powered security assessment tool that analyzes applications for vulnerabilities and recommends the exact patches needed to fix them. It runs on self-hosted, open-source AI models.

See how it works Get in touch
$ vulnfix scan --target staging.example-app.local --scope ./scope.yaml [✓] Authorization scope verified [✓] Reconnaissance complete: 14 endpoints discovered […] AI analysis in progress [HIGH] SQL injection in /api/search?q= Fix: use parameterized queries (see patch #1) [MED] Missing rate limiting on /login Fix: add rate limiter middleware (see patch #2) [✓] Report + 2 suggested patches written to ./vulnfix-report/
The problem

Security testing is slow, expensive, and often skipped.

Small teams and independent developers rarely have access to security experts. AI can help, but analyzing real applications takes millions of tokens, and commercial AI APIs make that cost unpredictable and out of reach. Sending sensitive vulnerability data to third-party APIs is also a privacy risk.

How it works

From scan to patch, in four steps.

Define the scope

You provide the target and a scope file proving you are authorized to test it. VulnFix refuses to run outside that scope.

Discover & scan

Standard open-source security tools map the application: endpoints, inputs, configurations, and dependencies.

AI analysis

Self-hosted open-source AI models review the findings, reason about attack patterns, and filter out false positives.

Fix recommendations

Every finding comes with a clear explanation, a risk rating, and a developer-ready patch or configuration fix.

Features

Built for developers, not just security experts.

Vulnerability detection

Identifies common risks such as the OWASP Top 10: injection, broken authentication, misconfigurations, and more.

Patch suggestions

Doesn't just report problems. It explains how to fix each one with code and configuration changes.

Private by design

AI models run on our own GPU servers. Your vulnerability data never leaves the environment.

Predictable cost

Self-hosted open-source models avoid per-token API pricing, making deep analysis affordable.

Scope enforcement

Mandatory authorization scope file. The tool only tests targets you are explicitly permitted to test.

Clear reports

Readable reports with risk ratings, so developers and managers can prioritize what to fix first.

Responsible use

Authorized testing only.

VulnFix is a defensive tool. It is designed to help owners find and fix weaknesses in their own systems.

  • Testing is performed only on systems we own or have explicit written permission to test.
  • Development and benchmarking use intentionally vulnerable lab applications in an isolated network.
  • The tool focuses on detection and remediation, not exploitation.
Roadmap

Where we are.

Now

Proof of Concept

Self-hosted AI model setup, scanner pipeline, and testing on lab applications.

Next

Benchmark & refine

Compare open-source models on detection accuracy and fix quality. Improve the AI agent.

Later

Public release

Early access for developers and small teams, with an open-source core.

Contact

Interested in VulnFix?

We're looking for feedback, early testers, and partners. Get in touch.