What Is ScanDrix And How Does It Work?

ScanDrix is an autonomous AI-powered code review and AST security scanning platform built for modern engineering teams. It integrates into your Git providers (GitHub, GitLab, Bitbucket, Azure Repos) to automatically review pull requests, detect vulnerabilities, suggest code fixes, and enforce custom Drixy rules.

How Does ScanDrix Differ From Traditional Linters Like SonarQube?

Traditional linters analyze files in isolation using rigid regex or pattern rules, resulting in high false-positive rates and zero understanding of code intent. ScanDrix performs deep Abstract Syntax Tree (AST) analysis combined with multi-model AI reasoning, understanding whole-codebase context, taint flows, and architectural boundaries.

What Are Drixy Rules And How Do I Configure Them?

Drixy rules are customizable code review and security policies. You can define rules globally across your organization, per repository, or choose from a library of community best practices. You can also run 'Dry Run' previews to test rule modifications against real historical PRs before enforcing them.

Which Git Providers And CI/CD Tools Does ScanDrix Support?

ScanDrix supports GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo out of the box. It also provides a CLI and team API keys for local developer workflows, pre-commit hooks, and custom CI/CD runners.

Does ScanDrix Train On Our Private Source Code?

No. ScanDrix never uses customer source code to train AI models. All code diffs are processed in ephemeral, isolated environments with strict zero-data-retention guarantees. For enterprise deployments, ScanDrix supports Bring Your Own Key (BYOK) and self-hosted on-premise installations.

How Fast Are ScanDrix Code Reviews On New Pull Requests?

ScanDrix is built for sub-minute reviews: an async worker architecture picks up webhook events without blocking CI pipelines. That is a design goal, not a measured guarantee — live service state is on the status page.

Can ScanDrix Suggest Inline Code Fixes?

Yes. When ScanDrix detects bugs, security vulnerabilities, or rule violations, it generates precise inline diff suggestions directly in the pull request review comments that developers can apply with a single click.

Can We Deploy ScanDrix On-Premise Or In Our Own VPC?

Yes. Enterprise customers can deploy ScanDrix in their own AWS, GCP, or Azure VPC, or in fully air-gapped on-premise environments with support for internal LLM endpoints (vLLM, Ollama) and enterprise SSO.

ScanDrix AI Inc.

We build the review layer.

ScanDrix is an engineering company building deterministic AST analysis for pull requests — so the bugs that span files stop slipping through review.

Founded: 2025
Focus: AST security review
Deployment: Cloud or self-hosted
Data policy: Zero retention

What we believe

Four commitments.

These constrain the product. Where a feature conflicts with one of them, the feature does not ship.

Your code is not our data

Zero code retention is an architectural constraint, not a policy page. Diffs are parsed in ephemeral workers and evicted as soon as a review is posted. We have no business model that depends on reading your source code, and we do not train models on it.

Deterministic before probabilistic

Pattern and taint analysis decide what is a finding. Models explain and draft patches. Keeping those layers separate is why results are reproducible and why the false-positive rate stays under 2.1% instead of in the tens of percent.

Honest benchmarks

We publish the category where we do badly as prominently as the one where we do well. Comparisons are run on a fixed corpus with a manual audit of every finding, and we report the methodology rather than just the headline.

Built for the reviewer, not the dashboard

A finding is only useful where the developer already is. Findings land as line-precise review comments with a commit button, not as a ticket waiting to be triaged.

How we got here

The short version.

The problem we hit

Our own review queue was the evidence. Every tool we tried either flooded us with false positives or went quiet on exactly the bugs that spanned files. Static rules could not see architecture, and AI review could not see the code that was not in the window.

The engine

So we built the missing layer: compile the codebase to an AST, propagate taint across file boundaries, evaluate deterministic rules, and only then hand candidates to a model for intent and patch drafting. Cross-file taint tracking shipped first because it was the largest gap.

Where we are

ScanDrix now reviews pull requests on GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo, with reviews designed for sub-minute turnaround. The work now is depth: more languages, more Drixy rules, and better explanations for the findings we already catch.

Talk to the team

We read every message.

Questions about the engine, a security review, or a self-hosted deployment — reach the people who built it.