Ship your AI-built app
with more confidence.

No. PushFix only looks at what a visitor or a signed-in user can see: pages, markup, bundle contents, network traffic, headers, DNS and TLS. Nothing is read from your repository and nothing is installed in your app.

Staging, preview or a test environment, always. PushFix detects production-looking URLs, warns you and stays conservative there. Active security testing belongs on an environment where breaking something does not affect real users.

The catalogue is built so that it cannot. 71 checks are purely passive, 207 send their own read-only requests, and only 6 write anything, always to disposable records the audit itself created and only with explicit write consent.

No destructive payloads, no denial-of-service or load testing, no brute-forcing beyond the configured attempt cap, no social engineering, no contacting real users, and nothing at all against hosts you have not authorized. The full list ships with every report.

Only for the checks that need a signed-in view, and only if you want them. Add a dedicated test account on the project's Logins screen and the next review signs in with it and checks what that account can reach. Email and password works today, and so does a one-time code when your app accepts a fixed code for a test account, as a staging code usually does. A magic link or single sign-on has to be completed by you, so those accounts are recorded and the area behind them stays unreviewed. Without an account, those checks are listed as skipped, never guessed at.

For a small allow-list of credential types that expose a read-only identity endpoint, PushFix makes a single non-mutating call and records only whether it authenticated. It never touches an endpoint that could write, send or cost money, and it only runs with active-testing consent.

A stable ID, severity, the affected surface, the evidence that produced it, reproduction steps, an explanation of why it matters, a confidence score and a suggested fix you can hand straight to your AI tool.

No, and it does not replace one. It is automated, external and non-destructive. It finds the classes of problem that automated review can prove and reports them with evidence; a manual penetration test goes further into business logic and chained exploits.

Not yet, and the report never pretends otherwise. The catalogue holds 284 checks; the deterministic engine executes the subset that can be judged from outside the app today, and it lists the rest as skipped, with the reason. A check that did not run is never counted as a pass, which is why a clean PushFix report is worth more than a clean score from a tool that guesses.

The tool that wrote the code reasons about intent. PushFix looks at what actually shipped: the responses, headers, bundle contents and pages a visitor receives. That is the difference between an account of the code and a statement about the running product.

Your first review is free and needs no card. Paid plans exist for regular reviews, larger sites and more projects, and past a plan's allowance you keep auditing at the plan rate rather than being blocked. The plans page has the current numbers.