Fix Plan

Every audit ends with a plan your agent can execute

The Fix Plan turns an audit into action: every finding with why it matters, a suggested diff, and what to test afterwards. Paste the Markdown into your AI coding agent, or pipe the JSON into your own tooling. You apply the fixes — in your repo, with your tests — so nothing breaks silently.

Run an audit API docs

How it works

STEP / 01

Audit runs as normal

All 62 verification layers — 58 deterministic scanners plus 4 AI engines — analyse your plugin exactly as before.

STEP / 02

Fix Plan is generated automatically

Every finding is structured into a single plan: location, why it matters, suggested fix, what to test after applying it, and confidence — at zero extra cost.

STEP / 03

Hand it to your dev team or AI agent

Download the Markdown and paste it into Cursor, Claude Code, or Copilot — or feed the versioned JSON to your own tooling. Fixes are applied in your environment, with your tests.

Fix Plan v2

Every finding ships with a suggested diff

Not “here’s a problem, good luck” — the exact change, with line numbers, a syntax-validation badge, and a test step. Apply by hand, or pull the structured plan from your agent with MCP · get_fix_plan(report_id).

includes/class-gateway.phpMedium · coding-standardssyntax valid

211  public function render_settings() {

212-   $rows = $wpdb->get_results(

213-     "SELECT * FROM {$wpdb->prefix}hs_transactions"

214-   );

212+   $rows = wp_cache_get( 'hs_transactions', 'harborstripe' );

213+   if ( false === $rows ) {

214+     $rows = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}hs_transactions" );

215+     wp_cache_set( 'hs_transactions', $rows, 'harborstripe', HOUR_IN_SECONDS );

216+   }

5 lines changed · test: settings-page query count drops 3 → 0

includes/class-rest.phpHigh · rest-authorization

Premium suggested diff

triple-validated · K3 + Opus + DeepSeek

Unlock with Premium

Standard and Advanced tiers get fix guidance + code snippets. Premium adds full suggested diffs, cross-validated by three frontier models — plus systemic refactor plans: when the same bug appears across your codebase, you get ONE coordinated plan (root cause, shared abstraction, ordered files, verification) instead of a dozen patches.

Test Generator

Prove the fix worked — with a real test

One click on any finding generates a PHPUnit test scaffold wired for Brain Monkey — the WordPress mocking framework — targeting exactly the behaviour the finding flagged. Drop it into your test suite, apply the fix, watch it pass.

PHPUnit + Brain Monkey scaffold per finding
Syntax-checked with php -l before download
Named for the finding — your agent knows what to make pass
The regression test that keeps the fix fixed

tests/GatewaySettingsCacheTest.phpphp -l valid

<?php
/**
 * Finding: Direct database query without caching
 * Generated by WP HealthKit Test Generator — PHPUnit + Brain Monkey
 */
class GatewaySettingsCacheTest extends \WPHealthKit\TestCase
{
    public function test_settings_query_is_cached(): void
    {
        $gateway = new \HarborStripe\Gateway();
        $gateway->render_settings();
        $this->assertNotFalse(
            wp_cache_get( 'hs_transactions', 'harborstripe' )
        );
    }
}

Fix-It

A patched ZIP — but only if it proves itself first

Fix-It takes a finding all the way: it fires a baseline exploit probe at your plugin inside the WordPress sandbox to confirm the vulnerability is real, applies a patch, then re-fires the same probe. The patched ZIP only exists if two things are true: the probe is rejected after the patch, and the plugin still activates cleanly. No flipped probe, no download — a patch that can't prove itself is never handed to you.

STEP 1

Baseline probe

The finding is exploited unauthenticated in the sandbox — proof it was real, not theoretical.

STEP 2

Patch applied

Deterministic fix where one exists, AI-generated patch otherwise — syntax-validated.

STEP 3

Re-probe

The identical attack is fired again. It must be rejected.

STEP 4

Verdict

Plugin must still activate. Only then does the patched ZIP become downloadable.

What's in every Fix Plan

Every finding includes impact, remediation guidance, and test-after-fix steps
Agent-safety flags mark findings that need human judgement, not mechanical patching
Suggested fixes carry a syntax-validation badge — malformed suggestions are flagged, not hidden
Premium tier: systemic refactor plans — one coordinated change that eliminates a whole class of bug, with root cause, ordered file list, and verification steps
Versioned JSON schema for CI, custom dashboards, and agent workflows
Markdown rendering designed to paste straight into an AI coding agent's context
Included on every tier — including free audits

Note: the original AutoFix product (unverified black-box patched ZIPs and one-off fix purchases) has been retired. The Fix Plan replaces it for remediation guidance, and Fix-It is its successor for patches — every Fix-It patch must flip its own exploit probe and keep the plugin activating before you can download it.