What Is ScanDrix And How Does It Work?

ScanDrix is an autonomous AI-powered code review and AST security scanning platform built for modern engineering teams. It integrates into your Git providers (GitHub, GitLab, Bitbucket, Azure Repos) to automatically review pull requests, detect vulnerabilities, suggest code fixes, and enforce custom Drixy rules.

How Does ScanDrix Differ From Traditional Linters Like SonarQube?

Traditional linters analyze files in isolation using rigid regex or pattern rules, resulting in high false-positive rates and zero understanding of code intent. ScanDrix performs deep Abstract Syntax Tree (AST) analysis combined with multi-model AI reasoning, understanding whole-codebase context, taint flows, and architectural boundaries.

What Are Drixy Rules And How Do I Configure Them?

Drixy rules are customizable code review and security policies. You can define rules globally across your organization, per repository, or choose from a library of community best practices. You can also run 'Dry Run' previews to test rule modifications against real historical PRs before enforcing them.

Which Git Providers And CI/CD Tools Does ScanDrix Support?

ScanDrix supports GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo out of the box. It also provides a CLI and team API keys for local developer workflows, pre-commit hooks, and custom CI/CD runners.

Does ScanDrix Train On Our Private Source Code?

No. ScanDrix never uses customer source code to train AI models. All code diffs are processed in ephemeral, isolated environments with strict zero-data-retention guarantees. For enterprise deployments, ScanDrix supports Bring Your Own Key (BYOK) and self-hosted on-premise installations.

How Fast Are ScanDrix Code Reviews On New Pull Requests?

ScanDrix is built for sub-minute reviews: an async worker architecture picks up webhook events without blocking CI pipelines. That is a design goal, not a measured guarantee — live service state is on the status page.

Can ScanDrix Suggest Inline Code Fixes?

Yes. When ScanDrix detects bugs, security vulnerabilities, or rule violations, it generates precise inline diff suggestions directly in the pull request review comments that developers can apply with a single click.

Can We Deploy ScanDrix On-Premise Or In Our Own VPC?

Yes. Enterprise customers can deploy ScanDrix in their own AWS, GCP, or Azure VPC, or in fully air-gapped on-premise environments with support for internal LLM endpoints (vLLM, Ollama) and enterprise SSO.

4 open roles · Remote friendly

Build the review layer.

We are a small team working on a problem that is genuinely hard: making automated code review good enough that engineering teams trust it with their security.

Open roles: 4
Location: Remote, EU/UK hours
Teams: Eng · Security · Product
Process: 2 conversations

Open positions

Where you would help.

We hire for judgement and curiosity. If a role is close but not exact, write to us anyway — the interesting work rarely fits a posting exactly.

Senior AST / Compiler Engineer

EngineerRemote (EU/UK)Full-time

Own the parsing and taint-propagation layers that make cross-file detection work. You will work on incremental tree-sitter parsing, dependency-cone computation, and making analysis fast on monorepos.

Application Security Researcher

SecurityRemote (EU/UK)Full-time

Build and validate Drixy rules against real vulnerability classes. If you enjoy turning a CVE write-up into a deterministic matcher that catches the bug before review, this is the role.

Developer Experience Engineer

ProductRemote (EU/UK)Full-time

Own the CLI, the GitHub App, and CI integrations. The goal is that connecting a repository takes two minutes and the first review lands before the author switches tabs.

Platform Engineer (Self-Hosted)

EngineerRemote (EU/UK)Full-time

Make the entire stack deploy cleanly inside customer VPCs and air-gapped networks — queue, workers, model endpoints, and upgrades without downtime.

Nothing that fits? Send a general application with something you have built.

How we work

The practical details.

Real hardware

A machine you choose, configured for the work rather than the video call.

Open by default

The CLI and rule format are documented publicly. We write things down.

Security time

Dedicated time each quarter for research on the classes of bug we are trying to catch.

Small team

You will talk to the people who wrote the engine, not a routing layer.

See what we actually built.

The engine matters more than the job description. Read how the analysis works before you write in.

Read the engineering blog About ScanDrix