verified security auto-fixes for python

Scan Python repos. Open security fixes you can trust.

AION scans a Python repository for a focused set of high-confidence security issues, generates a deterministic patch for each one, verifies it in isolation, and opens a pull request only for fixes that pass. If a fix can't be proven safe, it is reported for review instead of touching your code.

Get started See how it works
Detect
Semgrep + Context + LLM
Repair
Deterministic Patches
Verify
Syntax + AST + Semgrep
Ship
Verified Pull Requests

Intentionally small. The goal is a tool you can trust to run unattended on your repository — not a platform you have to operate.

What it does

  • Context-aware Python scanning with repository profiling and Semgrep triage
  • Deterministic patches for secrets, raw SQL, unsafe YAML/eval, shell injection, and weak hashing
  • A verification gate: every patch must parse, satisfy an AST assertion, and survive a Semgrep re-scan
  • Pull requests opened only for fixes that reach verified_fix

How it works

  1. Profile the repository (ORM, auth, DB patterns) for context.
  2. Detect incidents with Semgrep, heuristics, and optional LLM.
  3. Generate a deterministic patch artifact for supported issue types.
  4. Verify the patch in isolation.
  5. Open a PR for each verified fix; report the rest for review.

What it's for

  • Auto-remediating high-confidence security issues in Python services
  • Reviewing AI-generated code against repository-specific conventions
  • Detecting security drift over time with snapshots and a watch loop

What it does not do

  • No in-place production hot patching; it produces patches and PRs
  • Not a runtime control plane — no WAF, gateway, or deploy integration
  • Python-only by design