corefixhq/cfix-test repository overview

⁠CoreFix Code Scanner

CoreFix Code Scanner runs 5 open-source security scanners in parallel against your codebase — SAST, secrets, dependencies, infrastructure-as-code, and Kubernetes manifests. Findings are normalized, deduplicated across scanners, and AI-prioritized by real exploitability. One command. Zero configuration.

⁠Quick Start

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/code \
  -v ~/scan-results:/output \
  cfix:latest
  --model gpt-4o-mini

First results in under 4 minutes.

⁠What Gets Scanned

All scanners run in parallel inside the container. Results are normalized into a single format, deduplicated, and sent for AI enrichment.

⁠Usage

⁠Scan with all scanners (default)

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/code \
  -v ~/scan-results:/output \
  cfix:latest

⁠Run specific scanners only

Pass scanner names as the first argument. Default: osv,iac,secrets,k8s,sast

# Secrets and SAST only
docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/code \
  -v ~/scan-results:/output \
  cfix:latest secrets,sast

# Dependencies only
docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/code \
  -v ~/scan-results:/output \
  cfix:latest osv

⁠Scanner flags

⁠AI Enrichment

Scan findings are processed through CoreFix's AI pipeline:

1. Normalize — all scanner outputs converted to a common schema
2. Deduplicate — cross-scanner duplicates merged (e.g. OpenGrep and Gitleaks both flagging the same hardcoded secret)
3. AI Prioritize — each finding scored by real exploitability, reachability, and data exposure — not just CVSS
4. Remediation — fix suggestions generated with full codebase context

⁠Choose your model

--model gpt-4o-mini        # Fast, cost-efficient (default for open source)
--model gpt-5.4-mini       # Balanced accuracy and cost
--model deepseek-v4-flash  # Cost-efficient alternative
--model claude-sonnet-4.6  # Premium — higher accuracy (credits required)
--model gpt-4o             # Premium (credits required)

Full model list: docs.corefix.dev/docs/models⁠

⁠Bring Your Own Key (BYOK)

Use your own OpenAI-compatible API key to control AI costs:

docker run --rm \
  -e X_CFIX_API_KEY=cfix_live_YOUR_API_KEY \
  -v $(pwd):/code \
  -v ~/scan-results:/output \
  cfix:latest \
  --openai-api-key sk-YOUR_KEY \
  --model gpt-4o-mini

⁠Environment Variables

⁠CLI Options

⁠Volume Mounts

-v $(pwd):/code          # Mount current directory as source
-v ~/scan-results:/output # Mount local directory for results

⁠Viewing Results

• Dashboard — findings appear automatically at app.corefix.dev⁠ under your project, AI-enriched and deduplicated
• Local output — raw scanner results written to your mounted /output directory
• Shareable reports — generate and share HTML reports from the dashboard

⁠CI/CD Integration

Drop CoreFix into any CI/CD pipeline:

⁠GitHub Actions

- name: CoreFix Security Scan
  run: |
    docker run --rm \
      -e X_CFIX_API_KEY=${{ secrets.CFIX_API_KEY }} \
      -v ${{ github.workspace }}:/code \
      cfix:latest

⁠GitLab CI

security_scan:
  image: docker:24
  services:
    - docker:24-dind
  script:
    - |
      docker run --rm \
        -e X_CFIX_API_KEY=$CFIX_API_KEY \
        -v $CI_PROJECT_DIR:/code \
        cfix:latest

⁠Jenkins

stage('Security Scan') {
    steps {
        sh '''
            docker run --rm \
              -e X_CFIX_API_KEY=${CFIX_API_KEY} \
              -v ${WORKSPACE}:/code \
              cfix:latest
        '''
    }
}

⁠How It Works

Your Code ─→ [ CoreFix Container ]
                  │
                  ├── OpenGrep (SAST)      ──┐
                  ├── Gitleaks (Secrets)    ──┤
                  ├── OSV-Scanner (SCA)    ──┼──→ Normalize ──→ Deduplicate ──→ AI Prioritize
                  ├── KICS (IaC)           ──┤
                  └── Kubescape (K8s)      ──┘
                                                                                    │
                                              Dashboard ←── Reports ←── Findings ←──┘

• Scanners execute in parallel inside an isolated container
• Your source code is mounted read-only — nothing is modified
• Only findings (not source code) leave the container
• The container is stateless — nothing is retained between runs

⁠Pricing

• Free for public (open source) repositories — all scanners, AI enrichment, no limits
• Pay as you go for private repositories — $0.03/min runtime + LLM usage at 1.75× provider cost
• BYOK — bring your own LLM key, pay provider directly, 0.5× orchestration fee

Full pricing: corefix.dev/pricing⁠

⁠Image Tags

docker pull cfix:latest
docker pull cfix:1.0.0

⁠Security and Privacy

• Your source code is mounted read-only and never persisted inside the container
• Only scan findings and code snippets (not full source) are transmitted to CoreFix
• The container is stateless and isolated — destroyed after each run
• Self-hosted mode: scanners run entirely in your infrastructure
• Full privacy policy: corefix.dev/privacy⁠

⁠Links

• Website: corefix.dev⁠
• Documentation: docs.corefix.dev⁠
• Pricing: corefix.dev/pricing⁠
• Web Scanner: hub.docker.com/r/cfix-web⁠
• Support: [email protected]⁠

⁠Open Source Acknowledgements

CoreFix Code Scanner is built on: OpenGrep⁠ (LGPL-2.1), Gitleaks⁠ (MIT), OSV-Scanner⁠ (Apache-2.0), KICS⁠ (Apache-2.0), Kubescape⁠ (Apache-2.0).

Full attributions: docs.corefix.dev/acknowledgements⁠

Built with ❤️ in Bangalore, India — for developers everywhere.