AI Code Repair

Find the cracks.
Fix the future.

XCracks detects vulnerabilities in your code, proposes fixes, tests them, and opens review-ready pull requests. You approve every merge.

Start my free trial Log in
Detected
Proposed
Tested
Validated
Merged
Resolved
xcracks — findings
main
Filter findings…
3 Critical
CRIT
src/auth/session.ts
SQL Injection via template literal
Proposed
HIGH
src/api/upload.ts
Path traversal in file handler
Tested
HIGH
src/utils/crypto.ts
Weak random for token generation
Validated
MED
src/middleware/cors.ts
Overly permissive CORS origin
Detected
12 findings · 3 repos xcracks/ai-repair@main
The offer

Scanners hand you a backlog.
XCracks works through it.

Every finding moves through a defined pipeline: detected, proposed, tested, validated, then landed as a pull request you review before anything merges. You stay in control of every change.

Built for teams shipping fast with AI coding assistants

AI-generated code moves fast and introduces patterns a scanner flags but a busy engineer can't easily fix. XCracks closes that gap with AI-proposed, tested repairs.

No dedicated security team required

You get the analysis and the fix proposal, not just the alert. For teams of 2 to 30, that difference is the one between a resolved vulnerability and a ticket that lives forever in a backlog.

Every fix is a testable, reviewable pull request

XCracks runs your existing test suite against every proposed fix before it surfaces for review. Nothing merges autonomously. The PR is yours to approve, request changes on, or close.

What you get

AI-powered vulnerability detection

XCracks scans your repository for real vulnerabilities — injection flaws, path traversal, weak cryptography, insecure defaults — across the languages your team actually uses. It understands AI-generated code patterns that trip up traditional scanners.

Fix proposals, not just alerts

For each finding, XCracks generates a concrete code change — a real diff, in context, against your existing code. Not a generic recommendation. An actual fix you can read, understand, and accept or reject.

src/auth/session.ts
- const q = db.query(`SELECT * FROM users WHERE id = ?`)
+ const stmt = db.prepare('SELECT * FROM users WHERE id = ?')
+ const result = stmt.get(userId)

Test-validated before review

XCracks runs your existing test suite against each proposed fix. A fix that breaks a passing test gets flagged, not sent for review. Only fixes that pass reach your pull request queue.

Pull requests, not tickets

Every validated fix opens a pull request directly in your repository. Standard review flow: approve, request changes, or close. Nothing in XCracks bypasses your merge controls.

Pipeline

From detected weakness to review-ready fix.

XCracks enforces a clear stage progression for every vulnerability it finds. Nothing skips ahead, nothing sits undefined. At each stage the system tells you exactly what it did, what it found, and what needs your attention.

01
Detected

XCracks identifies the vulnerability — rule, severity, location in code, and the pattern that triggered it.

02
Proposed

An AI-generated fix diff is produced for the specific code location. The fix is scoped and minimal — no unnecessary changes.

03
Tested

Your existing test suite runs against the proposed change. A failing test blocks promotion. A pass moves the finding forward.

04
Validated

A secondary pass checks the fix against the original vulnerability pattern to confirm it actually closes the finding.

05
Merged

You approve the pull request through your normal review flow. XCracks marks the finding as merged once the PR lands.

06
Verified

XCracks re-scans after merge and marks the finding resolved. It will not resurface unless the same pattern reappears.

The old way

  • Scanner runs, drops 40 alerts into a backlog
  • Engineers triage manually — severity vs. business impact vs. time
  • A fix is written by hand, guessed from sparse scanner guidance
  • Tests are run manually, or often not at all
  • A PR is opened days or weeks later, if ever
  • The finding lives in a spreadsheet labeled 'low priority'

XCracks

  • XCracks detects the finding with context, not just a rule ID
  • Severity and stage are clear — no manual triage for fix candidates
  • A concrete fix diff is proposed, specific to your codebase
  • Tests run automatically; only passing fixes advance
  • A review-ready pull request opens in your repo
  • After merge, XCracks confirms the finding is gone
Pricing

Security tooling that fits a startup budget.

XCracks is built for engineering teams of 2 to 30. Sign up, connect your repository, and see your first findings in minutes.

What's included

  • Vulnerability scanning across your connected repositories
  • AI-generated fix proposals for each finding
  • Automated test-suite validation before review
  • Review-ready pull requests opened in your repo
  • Full six-stage pipeline: Detected through Verified
  • You control every merge — no autonomous changes

Get started

Start your free trial

Connect a repository, see your findings, and review your first fix proposal — before you commit to anything.

Start my free trial

No credit card to start. Connect GitHub, GitLab, or Bitbucket.

Common questions

Does XCracks merge code without me reviewing it?
No. XCracks opens pull requests — it does not merge them. Every fix lands in your repository as a PR that you approve, request changes on, or close. Nothing touches your main branch without your action.
What languages and frameworks does XCracks support?
XCracks supports the languages common to teams shipping with AI coding assistants. The specific list is updated as XCracks adds support — check back or sign up to see what your repository can surface today.
What if a proposed fix breaks my tests?
XCracks runs your existing test suite against every fix before it surfaces for review. A fix that causes a test failure is flagged and held at the Tested stage — it will not appear in your PR queue.
Can I use XCracks without a security team?
Yes, that is the point. XCracks is designed for engineering teams of 2 to 30 who don't have a dedicated security function. The platform handles the analysis and the fix — you handle the review.
Start today

Your scanner backlog isn't going to fix itself.

Connect a repository and see your first findings — with fix proposals attached — before you commit to a plan. XCracks works with the review workflow you already have.

Free trial

Start my free trial I already have an account
  • Connect GitHub, GitLab, or Bitbucket
  • Review-ready pull requests in your repo
  • You approve every merge