// tool reference · Governance & Advisory
AI Patch Generator Pro
Minimal, behavior-preserving secure refactors with before/after diffs.
What it does
Rewrites vulnerable code into a secure, behaviour-preserving version and shows it as a coloured diff with a per-change explanation. The emphasis is on preserving behaviour — a "fix" that breaks the feature is not a fix.
When to use it
- You have a finding and want the corrected code, not just advice.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| code | textarea | required | The vulnerable code. Up to — bytes / — lines. |
| language | select | optional | Language hint. |
| use_ai | checkbox | optional | AI generation. |
| authorized | checkbox | required | You confirm you may modify this code. |
What you get back
A unified diff plus per-change rationale with CWE IDs.
Worked example
Input
public function getUser($id) {
$sql = "SELECT * FROM users WHERE id = " . $id;
return $this->db->query($sql)->fetch();
}
Output (abridged)
--- a/UserRepository.php
+++ b/UserRepository.php
@@
public function getUser($id) {
- $sql = "SELECT * FROM users WHERE id = " . $id;
- return $this->db->query($sql)->fetch();
+ $st = $this->db->prepare('SELECT * FROM users WHERE id = ?');
+ $st->execute([(int)$id]);
+ return $st->fetch();
}
CHANGE 1 -- CWE-89 SQL Injection
$id was concatenated into SQL. Now bound as a parameter, so it can
never be parsed as SQL regardless of content.
CHANGE 2 -- defence in depth
(int) cast: this method is documented to take an integer id. The cast
makes that explicit and fails safe on unexpected input.
BEHAVIOUR PRESERVED
Same signature, same return shape, same single-row fetch. A caller
cannot tell the difference -- which is the point of a security fix.
VERIFY: ensure PDO::ATTR_EMULATE_PREPARES => false, or this is still
client-side interpolation wearing a prepared-statement costume.
How it works
AI generation constrained to preserve behaviour. Output is a diff you review and apply — nothing is written or executed. Diff rendering is HTML-escaped.
Limits
Read live from the platform configuration.
| Free | — (Pro only) |
| Pro | — scans |
| Max | — bytes / — lines |
Limitations — what it does not do
It sees the snippet, not the program. It cannot know your callers, your framework's escaping, or your test suite. Every diff is a proposal for review -- never apply one you have not read.
Privacy
Your code is sent to the AI provider. Do not paste secrets.
Standards
CWEOWASP Top 10