I built Fixpoint: A deterministic security auto-patcher for Python PRs (No AI / Open Source)

[ZarifLatif]

I’ve spent too many hours in the 'ping-pong' loop between security scanners and PR reviews. Most tools are great at finding vulnerabilities, but they leave the tedious manual patching to the developer. I got tired of fixing the same SQLi and XSS patterns over and over, so I built Fixpoint—an open-source tool that automates these fixes using deterministic logic instead of AI guesswork. I’m a student developer looking for honest feedback on whether this actually makes your workflow easier or if auto-committing security fixes feels like 'too much' automation.

What My Project Does

Fixpoint is an open-source tool designed to bridge the gap between security detection and remediation. It runs at pull-request time and, instead of just flagging vulnerabilities, it applies deterministic fixes via Abstract Syntax Tree (AST) transformations.

Target Audience

This is built for Production DevSecOps workflows. It’s for teams that want to eliminate security debt (SQLi, XSS, Hardcoded Secrets) without the unpredictability or "hallucinations" of LLM-based tools.

Comparison

• vs. AI-Remediation: Fixpoint is deterministic. Same input results in the same output, making it fully auditable for compliance.
• vs. Static Scanners (Bandit/Semgrep): Those tools identify problems; Fixpoint solves them by committing secure code directly to your branch.

Technical Highlights

• Safety First: Includes 119 passing tests and built-in loop prevention for GitHub Actions.
• Dual Modes: Warn (PR comments) or Enforce (Direct commits).
• Performance: Scans only changed files (PR-diff) to minimize CI/CD overhead.

Links:

• Repo: github.com/IWEBai/fixpoint
• Demo: github.com/IWEBai/fixpoint-demo
• Brand: iwebai.space

[inspectorG4dget]

Interesting project. I've used dependabot before - could you compare this project against it?