whereismyai
LegacyFixer
LegacyFixer is a security scanner that finds vulnerabilities in Python dependencies and creates optional fix pull requests.
LegacyFixer scans Python dependencies for security vulnerabilities and records findings without making code changes by default. Maintainers connect selected Python repositories through a self-service GitHub App to begin with passive scans. When enabled through repository settings, the tool proposes fixes through isolated branches and pull requests. It supports dependency layouts such as requirements.txt, nested requirements.txt, poetry.lock, Pipfile.lock, and setup.cfg install_requires. Each repository controls whether pull request creation is enabled and how many fix pull requests can remain open.
LegacyFixer at a glance
- Best for: Software engineer
- Runs on: Web
- Pricing: 7-day free trial; Pro $29/month
- Released: October 2026
- Category: AI coding tool
- Website: legacyfixer.ai
Key features
- Scans Python dependencies for security vulnerabilities
- Records passive scan results without code changes
- Creates optional fix pull requests through isolated branches
- Provides repository-level control over pull request creation
- Supports requirements.txt and poetry.lock layouts
- Integrates as a self-service GitHub App
Use it for
- Scan Python repositories for security vulnerabilities
- Review passive dependency security findings
- Manage controlled fix pull requests for dependencies
Alternatives to LegacyFixer
- jevgrep — Reduces coding agent costs by providing targeted, relevant repository context.
- Pixee — Automates vulnerability triage and generates actionable code fixes.
- Sourcery — Automates pull request reviews and bug detection in GitHub and GitLab.
- CodeScan Artex — It uses multiple parallel AI agents to read source code and verify vulnerabilities.
- Dsh Infinite Gen 5 — Provides thirty-six professional reverse engineering tools and multi-engine support.
- code2prompt — Written in Rust for high speed and efficiency when handling large codebases.
- SkillTotal — Scans code locally without accounts, telemetry, API tokens or executing the files.
- DeepSource — Automated code reviews that combine static analysis with AI agents.
- Vulert — Monitor software vulnerabilities through manifest uploads without needing installation.
- New Relic — Unified visibility across applications, infrastructure, and AI models.
- Sgrep — Runs locally without accounts or hosted indexes using small CPU models.
- sem — Performs entity-level diffs instead of line-based changes.
All LegacyFixer alternatives