Does Autofix work for every finding?

Autofix is available for supported findings. Where it is unavailable, use the remediation guidance and your team’s normal workflow.

Where does Autofix open pull requests?

In GitHub. Autofix works with GitHub repositories today.

Does Autofix merge or deploy the change?

No. It creates a proposed change for your team to review. Your team controls approval, merge and deployment.

How does Autofix check the fix?

Before it opens a pull request, Eureka scans the changed code to check the vulnerability is gone. If the scan still finds it, Eureka does not open a pull request and tells you the fix needs to be done by hand.

Does fixing a finding resolve its entire attack scenario?

Addressing one finding does not by itself establish that every issue or route in the scenario has been resolved. Review the remaining scenario context.

PRODUCT · AUTOFIX & REMEDIATION

Autofix writes the fix. You review and merge.

Eureka shows you what is wrong and how to fix it. For findings in GitHub repositories, press Autofix: an AI agent writes the fix, Eureka scans to check it, and opens a pull request.

Start with a scan See Developer Experience

30-day free trial. No credit card required.

Illustrative workflow

01

You press Autofix

On a finding in a GitHub repo

02

Eureka fixes and checks

Writes the fix, scans again, opens the PR

03

You review and merge

In your normal GitHub flow

Step 1 of 5, Eureka explains the finding

HOW IT WORKS · 5 STEPS

From finding to a reviewable change.

Eureka explains the finding

EUREKA DOES THIS

Each finding shows the affected code, what is wrong and how to fix it.

Finding detail with How Do I Fix It remediation guidance — Remediation guidance on a finding.

Eureka suggests the fix

EUREKA DOES THIS

See the affected code next to a suggested change, so you know exactly what would change.

LJS-1 · SQL INJECTIONTypeScript

AFFECTED CODEdata/static/codefixes/dbSchemaChallenge_1.ts

1models.sequelize.query(
2  "SELECT * FROM Products WHERE ((name LIKE '%" + criteria + "%') OR "
3  + "(description LIKE '%" + criteria + "%')) AND deletedAt IS NULL"
4)

PROPOSED CHANGEdata/static/codefixes/dbSchemaChallenge_1.ts

1models.sequelize.query(
2  "SELECT * FROM Products WHERE ((name LIKE $1) OR "
3  + "(description LIKE $1)) AND deletedAt IS NULL",
4  { bind: ['%' + criteria + '%'] }
5)

Remediation guidance for one finding, LJS-1. Review it against how your application works before applying it.

Fix it with Autofix

YOU CLICK. EUREKA DOES THE REST

Autofix works with GitHub repositories. Press the Autofix button to have Eureka launch an AI agent that will fix the vulnerability in the code, run a scan to verify that the vulnerability has been fixed, and open a GitHub PR for your review. If the scan still finds the vulnerability, Eureka does not open a PR and lets you know the fix needs to be done by hand.

Finding EJS-2, SQL injection, with the Autofix button in the finding header next to Actions — The Autofix button on a finding.

You review and merge

YOU DO THIS

The finding links to the pull request with View PR. Check the change, run your usual checks, and merge when you are happy. Eureka never merges for you.

Finding EJS-4, SQL injection, with a View PR button in the finding header linking to GitHub pull request #2 — EJS-4: View PR links to pull request #2.

GitHub pull request #2, 'Autofix: remediate vulnerability e615f756e234', open and awaiting approval. The Eureka bot comment lists the changed file and notes: Verified: a diff-aware Radar scan of the changed lines no longer reports this finding. Review required; merging is blocked until approved. — The pull request Autofix opens in GitHub, waiting for your review.

How Autofix checks the fix

Before it opens the pull request, Eureka scans the changed code to check the vulnerability is gone. The result is posted as a comment on the pull request.

Keep the work connected to the finding.

EUREKA DOES THIS

Keep the finding, remediation guidance and linked pull request available as the work progresses. Use the recorded activity to understand how the issue has been handled.

Finding ED2-4 activity: Radar SAST detection, AI-refined title and description, new remediation guidance, and a linked Jira ticket — Activity on a finding, including a linked Jira ticket.

ATTACK SCENARIOS

Carry the scenario context into the fix.

When a finding belongs to an attack scenario, use that context to understand why the change matters. After addressing a finding, review the remaining conditions and linked issues before treating the whole scenario as resolved.

Explore attack path management

Illustrative team workflow

01

Understand scenario

Conditions, linked findings, impact

02

Review proposed change

Your team inspects the fix

03

Reassess remaining conditions

Your team checks what is left

FAQ

Frequently asked questions.

Give your team a concrete change to review

Move from understanding the finding to inspecting a proposed fix, with the work connected to the vulnerability record.

Start with a scan See how Eureka works

30-day free trial. No credit card required.