How smzuhaib06/securefix-x works
SECUREFIX X is a web platform for evidence-grounded vulnerability investigation and human-approved remediation assurance. A developer submits a repository through the frontend; the API creates and persists an investigation, and the orchestrator gathers repository and security evidence, correlates findings, derives an invariant, adds grounded AI reasoning, and proposes a patch. Approval triggers patch application and verification before completion and report export. The README documents additional agent, RAG, adversarial, and mutation capabilities; some are represented at their documented subsystem paths because their wiring is not fully visible in the excerpts.
Main entry points: orchestrator.py Workflow orchestrator · main.py Backend API · page.tsx Investigation UI · investigation Progress and review UI
Components 25
Web experience
- Investigation UI
frontend/app/investigations/new/page.tsx - Progress and review UI
frontend/components/investigation - Frontend API client
frontend/lib/api.ts
Investigation workflow
- Workflow orchestrator
backend/app/orchestrator.py - Evidence agents
backend/app/agents - Evidence correlation
backend/app/correlation/engine.py - Invariant and root cause
backend/app/remediation/root_cause.py - Evidence package
backend/app/ai/evidence_package.py - Security knowledge RAG
backend/app/ai/rag.py - Grounded AI reasoning
backend/app/ai/security_reasoner.py - Node.js analysis
backend/app/nodejs/js_analyzer.py - Runtime and log analysis
backend/app/agents/runtime_agent.py
Remediation assurance
- Patch proposal and apply
backend/app/remediation/engine.py - Human approval
backend/app/main.py - Adversarial verification
backend/app/verification/engine.py - Mutation assurance
backend/app/verification/mutation.py
State and integrations
- Backend API
backend/app/main.py - Repository sandbox
backend/app/repository.py - AI provider
backend/app/ai/provider.py - Investigation state
backend/app/store.py - Persistent database
backend/app/db.py - Report export
backend/app/report.py
Demonstration target
- SecureBank demo API
demo-app/app/main.py - Demo SQLite database
demo-app/app/database.py
Other components
- Developer
Connections 27
- Developer → Investigation UI: starts investigation
- Investigation UI → Frontend API client: submits request
- Frontend API client → Backend API: calls API
- Backend API → Workflow orchestrator: starts workflow
- Backend API → Investigation state: reads and updates
- Backend API → Progress and review UI: streams progress
- Backend API → Report export: requests report
- Workflow orchestrator → Repository sandbox: resolves repository
- Repository sandbox → Developer: clones remote repository
- Workflow orchestrator → Evidence agents: runs agents
- Evidence agents → Node.js analysis: analyzes JavaScript
- Workflow orchestrator → Evidence correlation: correlates findings
- Workflow orchestrator → Invariant and root cause: derives invariant
- Workflow orchestrator → Evidence package: assembles evidence
- Workflow orchestrator → Security knowledge RAG: retrieves guidance
- Workflow orchestrator → Grounded AI reasoning: requests explanation
- Grounded AI reasoning → AI provider: generates reasoning
- Workflow orchestrator → Patch proposal and apply: proposes patch
- Backend API → Human approval: records decision
- Human approval → Workflow orchestrator: continues approved work
- Workflow orchestrator → Patch proposal and apply: applies approved patch
- Workflow orchestrator → Adversarial verification: verifies patch
- Adversarial verification → Mutation assurance: tests weakened fixes
- Workflow orchestrator → Runtime and log analysis: runs telemetry analysis
- Progress and review UI → Developer: presents findings and diff
- Report export → Backend API: returns Markdown
- SecureBank demo API → Demo SQLite database: reads and writes