fixinator.app

What It Is

Fixinator is a static code security scanning tool focused on ColdFusion/CFML, provided by Foundeo Inc. It reads source code without executing it, and can detect issues such as SQL injection, XSS, remote code execution, path traversal, insecure file access/uploads, weak hashing or encryption algorithms, and unsafe application settings. It can also identify known vulnerable libraries in CFML, Java, and JavaScript, as well as malicious CFML backdoors.

Core Capabilities and Deployment

In terms of protection type, Fixinator is closer to a CFML-focused SAST tool, with additional coverage for ColdFusion/Lucee upgrade compatibility checks, such as removed tags and functions as well as subtle behavior changes. For management, it supports automatic fixes or fix recommendations, scanner switching, silencing low-confidence results, viewing only high-risk items, and permanently ignoring confirmed issues. For integrations, the main documentation explicitly supports Jenkins, Travis CI, GitHub Actions, Bitbucket Pipelines, AWS CodeBuild, GitLab CI Jobs, and more, making it suitable for use at the commit or pipeline stage.

Pricing and Suitable Scale

Starter costs $64/month and includes 1,000 cloud scan requests and up to 2 developers. Fixer costs $128/month and includes 5,000 requests and up to 4 developers, positioned for CI/CD use. Enterprise costs $256/month and includes 10,000 requests and up to 8 developers, with unlimited local runs available. Freelancer costs $24/month. The page states that annual billing is the default, but the cart can be switched to monthly payment with cancellation at any time, and a trial can also be requested.

Pros and Cons

The main advantages are its clear positioning, deep coverage of CFML ecosystem security and compatibility issues, and CI/CD-friendly workflow. Enterprise can be deployed on your own Lucee 5+ or Adobe ColdFusion 2016+ server, and can even run completely offline. The drawbacks are that Starter/Fixer require sending code via HTTPS to the cloud API. Although Fixinator states that scans are performed in memory only and code is not written to disk, this may still be insufficient for highly sensitive source code. The page also does not disclose SOC 2, ISO 27001, SLA, or support response levels.

Who It’s For and Access from China

Fixinator is suitable for teams still using Adobe ColdFusion or Lucee, especially organizations that need pre-release audits, continuous scanning, or version upgrade assessments. The main content does not provide information about access from China, so connectivity to fixinator.app and api.fixinator.app should be tested directly. Payment methods are also not specified. If domestic network conditions, compliance requirements, or restrictions on source code leaving the country are concerns, it is advisable to first evaluate the Enterprise local deployment option, or compare it with SAST alternatives that offer local deployment and confirmed CFML rule support.