vulkro fix

Print suggested code fixes as patches, check that each one works, or apply the safe ones in place.

vulkro fix .                        # print fixes as unified diffs (read-only)
vulkro fix . --verify               # re-scan a patched copy: fixed / not-fixed / regressed
vulkro fix . --apply                # write only the patches proven fixed

By default it never changes your files. Pipe the output to git apply, or copy hunks by hand.

Three ways to fix

Remedies. For the common injection, redirect, SSRF, XSS, cookie, CORS, TLS, JWT, mass-assignment and missing-auth findings in JavaScript, TypeScript, Python, Go and Java, each finding gets a remedy: a diff when the code shape is recognised, otherwise steps with a before and after example. --verify applies the patches to a temporary copy, scans it again and labels each patch fixed (finding gone, no new Medium or higher finding on the changed lines), not-fixed or regressed. --apply writes only the fixed ones; a file that changed since the scan is skipped.

Templates (--write). A closed list of mechanical rewrites applied in place, such as cookie flags, MD5 or SHA-1 to SHA-256, yaml.load to yaml.safe_load, simple string-built SQL to parameters, and turning off debug=True. Any ambiguity is a refusal with a reason, not a guess. --dry-run previews them.

AI (--ai). For findings no template covers, your AI model proposes a diff. It is shown as verified only if a deterministic re-scan clears the finding with no new finding and an AI review agrees; otherwise it is refused with a reason. --ai alone is read-only; --ai --write applies only verified AI diffs, after the templates. See vulkro ai.

Flags

Flag	Description
[PATH]	Project root. Default ..
--finding <ID>	Only this finding (repeatable; alias --id). IDs come from vulkro scan --format json.
--rule <RULE>	Only findings of this rule, for example js-taint-sql-001 (repeatable).
--kind <KIND>	Only cors-wildcard, debug-on, hardcoded-secret or jwt-verify-disabled.
--verify	Re-scan a patched copy and label each patch. Never touches your files.
--apply	Write the patches --verify proves fixed.
--bundle <PATH>	Write a zip or directory with the verified patches, patched files, remedies as JSON and a README.
--write / --dry-run	Apply / preview the template rewrites.
--format <FMT>	text (default), json (each fix with finding id, rule, file:line, explanation and a git apply-ready diff) or diff (one combined patch).
--ai, --ai-model, --ai-url	Turn on the AI tier and pick its model or runtime.

Exit codes

Mode	Codes
Default, --dry-run, --verify, --bundle, --format diff	Always 0.
--write	0 nothing to fix, 1 a fix was applied, 2 IO failure or only refusals.
--apply	0 nothing to apply, 1 a verified patch was applied, 2 IO failure or no patch verified.

--ai never changes the exit code.

See also: vulkro mcp serve (the suggest_fixes and verify_fix tools).