Auto-fix turns audit findings into real pull requests.

Trendslop Pro opens a branch on your repo, applies the fix, and opens a PR. You review the diff, run your tests, and merge if it looks right. We never push directly to your default branch.

How it works

Auto-fix is a button on each failing check in your audit results. The flow is the same every time.

01

You click "Fix"

On any audit finding, click the Fix button. The first time, a consent modal explains exactly what's about to happen and asks you to confirm.

02

We create a branch

Named trendslop/fix-<check_id>-<timestamp>, branched off your default branch. We never modify your default branch directly.

03

We commit a change

For mechanical fixes — like adding entries to .gitignore — we apply the change as a real commit. For others, we add a TRENDSLOP_FIX.md file with step-by-step instructions.

04

We open a PR

Drafted as a regular pull request against your default branch. The description explains what changed, why, what we touched, and what to verify. You review and merge.

05

You run your tests

Always. Your CI runs against the PR branch like any other PR. If it passes, merge. If it fails, close the PR — nothing is committed to your default branch.

06

You merge or close

If the fix is good, merge it. If not, close it. You're in control of what enters your repo. We never auto-merge.

What we change. What we don't.

Some fixes are mechanical and safe. Others need human judgment. We treat the two categories very differently.

REAL CODE DIFFS

Mechanical fixes we apply directly

  • .gitignore missing entriesAppend .env, node_modules/, etc. to your existing .gitignore.
  • Outdated dependenciesBump pinned versions in package.json or requirements.txt.
  • Cookie security flagsAdd httpOnly and sameSite to res.cookie() calls.
  • HTTPS-only cookiesAdd secure: true to session cookie calls.
  • Privacy / Terms missingCreate stub /privacy.html and /terms.html placeholder files for you to fill in.
  • CORS wildcardReplace origin: '*' with a placeholder allowlist you customize.
  • Unsanitized HTML renderingAdd DOMPurify imports and wrap dangerous calls with sanitization.
INSTRUCTIONS ONLY

Judgment fixes we won't touch directly

  • Supabase RLS policiesThe right policy depends on what your data means. We tell you exactly what to write, but you write it.
  • Stripe webhook signaturesAdding signature verification requires knowing where you process events. Wrong placement is silent failure.
  • Secrets in your code or git historyRotating a leaked secret is your job — and rewriting git history is too destructive for us to do for you.
  • Missing auth on routesAuthentication setup is architectural. We can't guess your auth model.
  • SQL injectionFixing requires understanding query intent. A wrong parameterization can break functionality.
  • Open redirects, rate limiting, SES sender, HTTPS hostingAll require infrastructure or framework decisions we can't make for you.

For every finding we can't auto-fix with a real diff, we still open a PR — but it contains a TRENDSLOP_FIX.md file with detailed step-by-step instructions instead of code changes. You apply them manually and close the PR when done.

What can go wrong

Auto-fix is best-effort code generation, not magic. Here's what to watch for.

!
A fix could break your build

A dependency version bump might introduce an incompatible API. A cookie flag could break analytics that rely on JavaScript reading cookies. Always let your CI run against the PR branch before merging — that's the whole point of opening a PR rather than auto-committing.

!
We use the version of your code at audit time

If you've changed your repo since the audit ran, auto-fix may target line numbers that don't match anymore. We refuse to fix findings older than 7 days and ask you to re-audit first. This costs 20 credits but keeps fixes accurate.

!
Placeholder content needs your input

When we create stub privacy/terms pages, the text inside is placeholder ("FILL IN YOUR PRIVACY POLICY"). You must replace it with real policy text before merging — or before going to production at all. We open the PR as a draft until you remove the placeholder warning.

!
Allowlists need customization

Our CORS fix replaces wildcard with an example domain. Our open-redirect fix adds a placeholder allowlist. These default values are deliberately wrong — they'll fail loudly in production until you fill them in correctly. Better than silently exposing data.

!
We never modify your default branch directly

Every fix lives in a branch named trendslop/fix-*. You merge through GitHub's normal review flow. Closing a Trendslop PR has no side effects — it's the same as closing any other PR.

Pricing

Auto-fix uses credits, like audits. Diff-capable fixes (where we actually modify your code) cost 10 credits. Instruction-only PRs — where we hand you a structured markdown checklist of what to change — are free, bundled into the audit price.

DIFF FIX
10
credits — real code diff (Pro/Team)
INSTRUCTION-ONLY
FREE
included with every audit · all plans
FIX ALL
30
credits — bundle all findings from one audit
PLAN REQUIRED
PRO
Diff fixes unlock on Pro and Team. Hobby and Starter get free instruction-only PRs.

If a diff fix turns out to be wrong (the PR breaks your CI in a way that's clearly our bug, not your repo), reply in the PR or contact support — we'll credit you back. Bug-fix refunds are case-by-case, not automatic.

See full pricing →

Optional: auto-merge

By default, every fix is a draft PR that you review and merge yourself. If you trust your CI and want a hands-off experience, you can enable auto-merge in Settings.

DEFAULT

Manual merge

  • Fix PR opens as a draftYou mark it "ready for review" when satisfied.
  • You merge through GitHub's normal flowSame as any other PR — review, approve, merge, optionally squash.
  • Safer for repos without CINothing reaches your default branch without your explicit action.
  • Default for all accountsYou opt in to auto-merge if you want it.
OPT-IN

GitHub native auto-merge

  • Uses GitHub's built-in auto-merge featureRespects any branch protection rules you've set: required reviews, required status checks.
  • Merges when CI passesIf your repo has GitHub Actions or any required status check, the PR waits for them to succeed, then merges.
  • Merges immediately if no CI existsThis is the dangerous case. You'll see a warning before enabling.
  • Toggle anytime in SettingsDoesn't retroactively merge existing PRs — only applies to new fixes after you enable it.

Auto-merge is per-user, not per-repo. If you enable it, every repo's fix PRs will use it. If you want different behavior per repo, leave auto-merge OFF and set up branch protection rules on the repos where you want more caution.

Common questions

Can I auto-fix a finding from an old audit?

Only if the audit ran within the last 7 days. After that we refuse and ask you to re-audit (20 credits). Reason: your repo may have changed since the audit, and applying a fix to outdated line numbers is dangerous.

What permissions does Trendslop need on my GitHub?

For audits alone, read access. For auto-fix, we need contents: write and pull_requests: write so we can create branches and open PRs. We never request push access to your default branch or any admin permissions.

Will my CI run on the fix PRs?

Yes — Trendslop PRs are normal pull requests from GitHub's perspective. Your existing CI workflows trigger on them. If your CI fails, that's a strong signal not to merge the fix.

What happens to my credits if I close the PR without merging?

Credits are spent the moment we open the PR. We don't refund based on whether you merge — opening a PR involves the same backend work either way. Think of it like API costs: you pay for the call, not the outcome.

Does auto-fix work on private repos?

Yes — if the Trendslop GitHub App has access to the repo (private or public), auto-fix works. Repos you didn't grant access to during install won't show up.

What's in the PR description?

A summary of what we changed and why, a checklist of things you should verify before merging, a link to the original audit finding, and the relevant docs from trendslop.ai/docs. We try to make every PR a self-contained explanation.

What if I have 30 open Trendslop PRs from past audits?

For now, you close the ones you don't want — same as any other PR. Auto-archive of stale PRs is on the roadmap. In v1 we open one PR per fix; a "consolidate all fixes into one PR" mode is coming.

How does auto-merge work, and is it safe?

Auto-merge uses GitHub's native feature. When enabled, we tell GitHub "merge this PR when its required checks pass." If your repo has GitHub Actions or branch protection, the PR waits. If your repo has no required checks, it merges immediately — which is why we show a warning when you first enable the setting. Default is OFF. Find the toggle in Settings → Pull request behavior.

Can I undo a merged auto-fix?

Auto-fix doesn't have a special undo button — but a Trendslop PR is just a normal commit on your default branch once merged. git revert <commit> works exactly like any other revert.

Ready to try?
Run an audit, then click Fix.

You don't need to commit to Pro upfront. Hobby's free audit shows you what auto-fix would target. Upgrade only if you want the real diffs.