What Is ScanDrix And How Does It Work?

ScanDrix is an autonomous AI-powered code review and AST security scanning platform built for modern engineering teams. It integrates into your Git providers (GitHub, GitLab, Bitbucket, Azure Repos) to automatically review pull requests, detect vulnerabilities, suggest code fixes, and enforce custom Drixy rules.

How Does ScanDrix Differ From Traditional Linters Like SonarQube?

Traditional linters analyze files in isolation using rigid regex or pattern rules, resulting in high false-positive rates and zero understanding of code intent. ScanDrix performs deep Abstract Syntax Tree (AST) analysis combined with multi-model AI reasoning, understanding whole-codebase context, taint flows, and architectural boundaries.

What Are Drixy Rules And How Do I Configure Them?

Drixy rules are customizable code review and security policies. You can define rules globally across your organization, per repository, or choose from a library of community best practices. You can also run 'Dry Run' previews to test rule modifications against real historical PRs before enforcing them.

Which Git Providers And CI/CD Tools Does ScanDrix Support?

ScanDrix supports GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo out of the box. It also provides a CLI and team API keys for local developer workflows, pre-commit hooks, and custom CI/CD runners.

Does ScanDrix Train On Our Private Source Code?

No. ScanDrix never uses customer source code to train AI models. All code diffs are processed in ephemeral, isolated environments with strict zero-data-retention guarantees. For enterprise deployments, ScanDrix supports Bring Your Own Key (BYOK) and self-hosted on-premise installations.

How Fast Are ScanDrix Code Reviews On New Pull Requests?

ScanDrix is built for sub-minute reviews: an async worker architecture picks up webhook events without blocking CI pipelines. That is a design goal, not a measured guarantee — live service state is on the status page.

Can ScanDrix Suggest Inline Code Fixes?

Yes. When ScanDrix detects bugs, security vulnerabilities, or rule violations, it generates precise inline diff suggestions directly in the pull request review comments that developers can apply with a single click.

Can We Deploy ScanDrix On-Premise Or In Our Own VPC?

Yes. Enterprise customers can deploy ScanDrix in their own AWS, GCP, or Azure VPC, or in fully air-gapped on-premise environments with support for internal LLM endpoints (vLLM, Ollama) and enterprise SSO.

Troubleshooting

Symptom-first fixes for reviews that don't trigger, webhook failures, and CLI errors.

Reviews are not triggering

Work through this list in order — it resolves the large majority of cases:

Is the integration connected?

Settings → Integrations should show the provider as connected with a recent sync time. Reconnect if it shows Action required (usually an expired token after a credential rotation).

Is the repository granted?

Only explicitly selected repositories are reviewed. Add the repo, or switch the integration to "all repositories".

Did the webhook arrive?

Integrations → Last deliveries lists recent events. If the list is empty, the provider isn't reaching you — go to Webhook Setup and register manually.

Is the PR eligible?

Draft PRs and PRs labeled scandrix-skip are skipped by default. Check path filters in scandrix.yml — a PR touching only ignored paths produces a Skipped status, not silence.

Check the check run

Open the PR's checks tab. A Failed status with a log link means analysis errored after retries — the log names the failing stage.

Webhook received but no comment

Symptom	Likely cause	Fix
Event logged, review never starts	Idempotency collision (re-delivery of same commit)	Push an empty commit or re-run from Reviews → Re-run
Review completes, zero comments	Nothing violated active rules	Expected — `Approved` with no comments
Comments appear on old PR only	Processing backlog	Check worker health `/readyz`; queue depth metric should drain
Duplicate comments	Two delivery paths (webhook + CI job)	Remove one, or keep both — dedupe needs the same commit SHA

CLI errors

401 unauthorized Team key missing, malformed, or revoked. Echo it (never print it in shared terminals): echo ${#SCANDRIX_TEAM_KEY} should be > 20. Rotate/regenerate in Settings → API Keys if needed.

429 too many requests Rate limit per key — wait for the Retry-After window or use a different team key for parallel CI shards.

config validate fails Line-anchored YAML error. Common: tabs (use spaces), quoting on/off values as booleans, or a rule ID not in the catalog — scandrix rules list shows valid IDs.

No findings but CI should fail Blocking severity is configured above your findings' severity. Check Settings → Merge Policies, or pass --fail-on warning in CI.

Provider-side errors

GitHub 403 on comments — app missing from the repo, or branch protection blocking bot pushes to the check; reinstall the app (GitHub App Setup).
GitLab 401 — project access token expired or missing api scope.
Azure 401 — PAT expired or missing PR-threads write scope.

Still failing?

Email hello@scandrix.dev with the inquiryId/review ID shown in the dashboard — it carries enough context for us to trace the event through the queue without you sharing source code.

PreviousWhy Reviews Pause or Don't Trigger NextFAQ