Autofixes

Autofix generates a fix for a code security finding, pushes it to a new branch in your repository, and opens a pull request from it. You review and merge the PR like any other change. Nothing reaches your target branch without your approval. When the PR merges, an automatic rescan of the repository marks the finding resolved.

Generating a fix

On a finding, open the Autofix menu and choose Generate fix. A confirmation shows which repository will receive the pull request. Confirm with Generate fix and the workflow starts.

You can watch its progress from the same menu, and the resulting pull request includes a description of what was changed and why.

Review the fix like you’d review a contractor’s first PR. It’s AI-generated, and while it’s produced with the finding’s full context, it can be incomplete or take an approach you wouldn’t. If the fix isn’t right, close the PR and fix the finding manually.

Requirements

Autofixes need write access to open pull requests, which is granted per integration connection:

• For GitHub, the Oneleet Code GitHub App with the Autofixes toggle enabled. The read-only variant of the integration can’t open pull requests. See the GitHub (Code) integration for the difference and how to switch.
• The Autofix menu only appears on findings in repositories whose connection allows autofixes.

Privacy

Generating a fix requires sending the relevant code to third-party AI model providers, as noted in the confirmation dialog. See the Oneleet privacy policy for details on subprocessors.

Via API and MCP

Autofix workflows can also be triggered programmatically, for example from an AI assistant connected to the Oneleet MCP server.