Sign inSign up

corefixhq/cfix

By corefixhq

•Updated about 4 hours ago

Security scanner: SAST, secrets, SCA, IaC, K8s — 5 scanners, one command, AI-prioritized findings.

Image
Security
Developer tools
0

10K+

corefixhq/cfix repository overview

⁠CoreFix Code Scanner

Find it at runtime. Fix it in code.

CoreFix Code Scanner runs 5 open-source security scanners in parallel against your codebase — SAST, secrets, dependencies, infrastructure-as-code, and Kubernetes manifests. Findings are normalized, deduplicated across scanners, and AI-prioritized by real exploitability. One command. Zero configuration.

⁠Quick Start

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/code \
  -v ~/scan-results:/output \
  cfix:latest
  --model gpt-4o-mini

First results in under 4 minutes.

⁠What Gets Scanned

ScannerCategoryWhat It Finds
OpenGrepSASTInjection flaws, insecure patterns, logic bugs across 30+ languages
GitleaksSecretsAPI keys, tokens, passwords in source code and full git history
OSV-ScannerSCAKnown CVEs in open source dependencies with reachability analysis
KICSIaCMisconfigurations in Terraform, CloudFormation, Dockerfile, Helm
KubescapeKubernetesRBAC issues, pod security, NSA-CISA and CIS benchmark violations

All scanners run in parallel inside the container. Results are normalized into a single format, deduplicated, and sent for AI enrichment.

⁠Usage

⁠Scan with all scanners (default)
docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/code \
  -v ~/scan-results:/output \
  cfix:latest
⁠Run specific scanners only

Pass scanner names as the first argument. Default: osv,iac,secrets,k8s,sast

# Secrets and SAST only
docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/code \
  -v ~/scan-results:/output \
  cfix:latest secrets,sast

# Dependencies only
docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/code \
  -v ~/scan-results:/output \
  cfix:latest osv
⁠Scanner flags
FlagScannerDescription
sastOpenGrepStatic application security testing
secretsGitleaksSecret and credential detection
osvOSV-ScannerDependency vulnerability scanning
iacKICSInfrastructure-as-code scanning
k8sKubescapeKubernetes security auditing

⁠AI Enrichment

Scan findings are processed through CoreFix's AI pipeline:

  1. Normalize — all scanner outputs converted to a common schema
  2. Deduplicate — cross-scanner duplicates merged (e.g. OpenGrep and Gitleaks both flagging the same hardcoded secret)
  3. AI Prioritize — each finding scored by real exploitability, reachability, and data exposure — not just CVSS
  4. Remediation — fix suggestions generated with full codebase context
⁠Choose your model
--model gpt-4o-mini        # Fast, cost-efficient (default for open source)
--model gpt-5.4-mini       # Balanced accuracy and cost
--model deepseek-v4-flash  # Cost-efficient alternative
--model claude-sonnet-4.6  # Premium — higher accuracy (credits required)
--model gpt-4o             # Premium (credits required)

Full model list: docs.corefix.dev/docs/models⁠

⁠Bring Your Own Key (BYOK)

Use your own OpenAI-compatible API key to control AI costs:

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/code \
  -v ~/scan-results:/output \
  cfix:latest \
  --openai-api-key sk-YOUR_KEY \
  --model gpt-4o-mini

⁠Environment Variables

VariableRequiredDescription
X_CFIX_API_KEYYesYour CoreFix API key from app.corefix.dev⁠
DEBUGNoSet to app:* for verbose debug logging

⁠CLI Options

FlagRequiredDescription
--openai-api-keyNoYour own OpenAI-compatible API key (BYOK)
--modelNoAI model for enrichment (see model list above)

⁠Volume Mounts

MountContainer PathDescription
Your project directory/codeSource code to scan (read-only)
Output directory/outputWhere raw scan results are written
-v $(pwd):/code          # Mount current directory as source
-v ~/scan-results:/output # Mount local directory for results

⁠CI/CD Integration

Drop CoreFix into any CI/CD pipeline:

⁠GitHub Actions
- name: CoreFix Security Scan
  run: |
    docker run --rm \
      -e X_CFIX_API_KEY=${{ secrets.CFIX_API_KEY }} \
      -v ${{ github.workspace }}:/code \
      cfix:latest
⁠GitLab CI
security_scan:
  image: docker:24
  services:
    - docker:24-dind
  script:
    - |
      docker run --rm \
        -e X_CFIX_API_KEY=$CFIX_API_KEY \
        -v $CI_PROJECT_DIR:/code \
        cfix:latest
⁠Jenkins
stage('Security Scan') {
    steps {
        sh '''
            docker run --rm \
              -e X_CFIX_API_KEY=${CFIX_API_KEY} \
              -v ${WORKSPACE}:/code \
              cfix:latest
        '''
    }
}

⁠How It Works

Your Code ─→ [ CoreFix Container ]
                  │
                  ├── OpenGrep (SAST)      ──┐
                  ├── Gitleaks (Secrets)    ──┤
                  ├── OSV-Scanner (SCA)    ──┼──→ Normalize ──→ Deduplicate ──→ AI Prioritize
                  ├── KICS (IaC)           ──┤
                  └── Kubescape (K8s)      ──┘
                                                                                    │
                                              Dashboard ←── Reports ←── Findings ←──┘
  • Scanners execute in parallel inside an isolated container
  • Your source code is mounted read-only — nothing is modified
  • Only findings (not source code) leave the container
  • The container is stateless — nothing is retained between runs

⁠Image Tags

TagDescription
latestLatest stable release
x.y.zSpecific version (e.g. 1.0.0)
docker pull cfix:latest
docker pull cfix:1.0.0

⁠Security and Privacy

  • Your source code is mounted read-only and never persisted inside the container
  • Only scan findings and code snippets (not full source) are transmitted to CoreFix
  • The container is stateless and isolated — destroyed after each run
  • Self-hosted mode: scanners run entirely in your infrastructure
  • Full privacy policy: corefix.dev/privacy⁠

⁠Links

⁠Open Source Acknowledgements

CoreFix Code Scanner is built on: OpenGrep⁠ (LGPL-2.1), Gitleaks⁠ (MIT), OSV-Scanner⁠ (Apache-2.0), KICS⁠ (Apache-2.0), Kubescape⁠ (Apache-2.0).

Full attributions: docs.corefix.dev/acknowledgements⁠

Built with ❤️ in Bangalore, India — for developers everywhere.

Tag summary

Content type

Image

Digest

sha256:79ba7c445…

Size

2.6 GB

Last updated

about 4 hours ago

docker pull corefixhq/cfix