What Is ScanDrix And How Does It Work?

ScanDrix is an autonomous AI-powered code review and AST security scanning platform built for modern engineering teams. It integrates into your Git providers (GitHub, GitLab, Bitbucket, Azure Repos) to automatically review pull requests, detect vulnerabilities, suggest code fixes, and enforce custom Drixy rules.

How Does ScanDrix Differ From Traditional Linters Like SonarQube?

Traditional linters analyze files in isolation using rigid regex or pattern rules, resulting in high false-positive rates and zero understanding of code intent. ScanDrix performs deep Abstract Syntax Tree (AST) analysis combined with multi-model AI reasoning, understanding whole-codebase context, taint flows, and architectural boundaries.

What Are Drixy Rules And How Do I Configure Them?

Drixy rules are customizable code review and security policies. You can define rules globally across your organization, per repository, or choose from a library of community best practices. You can also run 'Dry Run' previews to test rule modifications against real historical PRs before enforcing them.

Which Git Providers And CI/CD Tools Does ScanDrix Support?

ScanDrix supports GitHub, GitLab, Bitbucket, Azure Repos, and Forgejo out of the box. It also provides a CLI and team API keys for local developer workflows, pre-commit hooks, and custom CI/CD runners.

Does ScanDrix Train On Our Private Source Code?

No. ScanDrix never uses customer source code to train AI models. All code diffs are processed in ephemeral, isolated environments with strict zero-data-retention guarantees. For enterprise deployments, ScanDrix supports Bring Your Own Key (BYOK) and self-hosted on-premise installations.

How Fast Are ScanDrix Code Reviews On New Pull Requests?

ScanDrix is built for sub-minute reviews: an async worker architecture picks up webhook events without blocking CI pipelines. That is a design goal, not a measured guarantee — live service state is on the status page.

Can ScanDrix Suggest Inline Code Fixes?

Yes. When ScanDrix detects bugs, security vulnerabilities, or rule violations, it generates precise inline diff suggestions directly in the pull request review comments that developers can apply with a single click.

Can We Deploy ScanDrix On-Premise Or In Our Own VPC?

Yes. Enterprise customers can deploy ScanDrix in their own AWS, GCP, or Azure VPC, or in fully air-gapped on-premise environments with support for internal LLM endpoints (vLLM, Ollama) and enterprise SSO.

GitHub App Setup

Install the ScanDrix GitHub App, grant minimal permissions, and scope repository access.

The ScanDrix GitHub App is the recommended way to connect GitHub.com and GitHub Enterprise Cloud organizations.

Install

In the ScanDrix dashboard, open Settings → Integrations → GitHub.
Click Install GitHub App — you are sent to GitHub with the permission set pre-selected.
Choose the account or organization to install on.
Select repositories: all, or an explicit list (you can change this later).

Permissions granted

ScanDrix requests only what a review needs:

Permission	Why
Contents: read	Read the diff and surrounding context
Pull requests: read & write	Post review comments and summaries
Checks: read & write	Publish the review status check
Metadata: read	Repository name, branch, default branch
Webhooks (app-level)	Receive PR events

ScanDrix does not request admin, workflows, or write access to code. Reviews are comments and checks — the app can never push commits or modify files.

What happens after install

GitHub begins delivering pull_request and push webhooks to ScanDrix. The first PR after installation triggers the baseline pass described in Review Flow.

Selecting repositories

All repositories — new repos are picked up automatically as they are created or transferred into the org.
Selected repositories — grant per-repo; add or remove anytime without reinstalling.

Repository access is enforced by GitHub itself: ScanDrix's token is scoped to the grant, so a removed repository becomes unreadable immediately.

GitHub Enterprise Server

For GHES, use the self-hosted deployment and register a GitHub App on your instance — see Self-Hosted Deployment. Webhook setup is manual: see Webhook Setup.

Troubleshooting

No reviews appearing — check the app is installed for the repo's org, and the repo is in the grant list (Settings → Integrations shows sync state).
Reviews stopped after org transfer — reinstall the app on the new account.
Duplicate reviews — ensure you haven't also registered a manual webhook for the same events; remove one.

PreviousCI/CD Pipeline Integration NextGitLab CI/CD