What Is ScanDrix And How Does It Work?

ScanDrix is an autonomous AI-powered code review and AST security scanning platform built for modern engineering teams. It integrates into your Git providers (GitHub, GitLab, Bitbucket, Azure Repos) to automatically review pull requests, detect vulnerabilities, suggest code fixes, and enforce custom Drixy rules.

How Does ScanDrix Differ From Traditional Linters Like SonarQube?

Traditional linters analyze files in isolation using rigid regex or pattern rules, resulting in high false-positive rates and zero understanding of code intent. ScanDrix performs deep Abstract Syntax Tree (AST) analysis combined with multi-model AI reasoning, understanding whole-codebase context, taint flows, and architectural boundaries.

What Are Drixy Rules And How Do I Configure Them?

Drixy rules are customizable code review and security policies. You can define rules globally across your organization, per repository, or choose from a library of community best practices. You can also run 'Dry Run' previews to test rule modifications against real historical PRs before enforcing them.

Which Git Providers And CI/CD Tools Does ScanDrix Support?

ScanDrix supports GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo out of the box. It also provides a CLI and team API keys for local developer workflows, pre-commit hooks, and custom CI/CD runners.

Does ScanDrix Train On Our Private Source Code?

No. ScanDrix never uses customer source code to train AI models. All code diffs are processed in ephemeral, isolated environments with strict zero-data-retention guarantees. For enterprise deployments, ScanDrix supports Bring Your Own Key (BYOK) and self-hosted on-premise installations.

How Fast Are ScanDrix Code Reviews On New Pull Requests?

ScanDrix is built for sub-minute reviews: an async worker architecture picks up webhook events without blocking CI pipelines. That is a design goal, not a measured guarantee — live service state is on the status page.

Can ScanDrix Suggest Inline Code Fixes?

Yes. When ScanDrix detects bugs, security vulnerabilities, or rule violations, it generates precise inline diff suggestions directly in the pull request review comments that developers can apply with a single click.

Can We Deploy ScanDrix On-Premise Or In Our Own VPC?

Yes. Enterprise customers can deploy ScanDrix in their own AWS, GCP, or Azure VPC, or in fully air-gapped on-premise environments with support for internal LLM endpoints (vLLM, Ollama) and enterprise SSO.

Webhook Setup

Manually register webhooks for GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo when automatic registration isn't possible.

Automatic webhook registration works for cloud providers when the integration has permission. Register manually for self-managed instances, restricted orgs, or when a webhook was deleted.

ScanDrix side

The webhook URL and rotating secret are shown under Settings → Integrations → <provider> → Webhooks:

code

URL:   https://<your-host>/api/webhooks/<provider>
Secret: <shared secret>     # rotate per integration

Provider recipes

GitHub

Settings → Webhooks → Add webhook

Payload URL: https://<your-host>/api/webhooks/github
Content type: application/json
Secret: paste the ScanDrix secret
Events: Let me select individual → Pull requests, Pushes
Active: ✓

Verify with the redelivery button — ScanDrix answers ping events with 202.

GitLab

Settings → Webhooks

URL: https://<your-host>/api/webhooks/gitlab
Secret token: ScanDrix secret
Triggers: ✓ Merge request events, ✓ Push events
SSL verification: ✓

Bitbucket Cloud

Repository settings → Webhooks → Add webhook

URL: https://<your-host>/api/webhooks/bitbucket
Triggers: Pull request created, updated; Push

Bitbucket has no shared-secret header — bind the integration with your app password and rely on TLS; optionally allow-list ScanDrix egress IPs (shown in the dashboard).

Azure Repos

Project settings → Service hooks → New subscription → Webhooks

Event: Pull request created (add a second for updated)
URL: https://<your-host>/api/webhooks/azure
Basic auth / secret: ScanDrix secret

Forgejo

Settings → Webhooks → Add

Target URL: https://<your-host>/api/webhooks/forgejo
Content type: application/json
Secret: ScanDrix secret
Events: push, pull_request

Signature validation

ScanDrix rejects unsigned or mismatched payloads:

Provider	Header checked
GitHub	`X-Hub-Signature-256` (HMAC-SHA256 of raw body)
GitLab	`X-Gitlab-Token`
Azure	basic-auth/secret header
Forgejo	`X-Gitea-Signature`

The webhook secret is a credential. Never commit it, never log it, rotate it from the dashboard the moment it might be exposed — rotations take effect on the next delivery and the old secret is rejected immediately.

Verifying delivery

After saving, send a test event from the provider UI, then check Settings → Integrations → Last deliveries in ScanDrix — each shows status code, latency, and the last 1 KB of the response. Persistent 401 = secret mismatch; 404 = wrong path/provider segment; 400 = body stripped by a proxy (see Reverse Proxy & TLS).

PreviousDatabase Migrations & Pooling NextKnowledge Base