Find›Prioritize›Fix›Prove
Scanners find. NextFix decides.
NextFix™ looks at an application and tells you which of its vulnerabilities actually matter, in what order, and why. It does not try to find more issues. Scanners already find thousands; the job is to work out which ones an attacker can reach, which are exposed, and which are being exploited, and to hand both the executive and the engineer a short list with the evidence attached.
Version 1.1.0. Free and open source under Apache 2.0. macOS, Linux and Docker on the download page.
Three questions
Reachable, exposed, exploited
A scanner knows that a package you installed has a published warning. It does not know whether anyone can get to the flaw. NextFix answers three questions about each one.
Can a request get to the flawed code?
NextFix reads your source, maps which function calls which, finds the web addresses your app answers to, and traces the path from a route to the vulnerable call, including the exact piece of request data that reaches it.
Is that route open to the world?
Whether the route needs a login, whether the app is published on a network port, whether the internet can reach it at all according to its infrastructure files, and, from your own access logs, whether anyone has actually called that route in the last 30 days.
Is anyone attacking it right now?
Whether the vulnerability is on CISA's list of ones being exploited in the wild, and the EPSS estimate of how likely it is to be exploited in the next 30 days.
On real applications
Four out of five findings need no action right now
On real applications, four out of five findings a scanner reports need no action right now, and NextFix says why for each one. Measured on 10 October 2026 against open-source applications, cloned fresh.
| Application | Findings | Need action | Set aside or watched, with evidence |
|---|---|---|---|
| OWASP Juice Shop (Express, TypeScript) | 87 | 10 | 77 (89%) |
| OWASP NodeGoat (Express) | 311 | 4 | 307 (99%) |
| Flask microblog | 56 | 10 | 46 (82%) |
| OWASP PyGoat (Django) | 141 | 20 | 121 (86%) |
| Demo app (ships with NextFix) | 20 | 4 | 16 (80%) |
NextFix also found every registered route on six Go applications, and 87% to 100% of them on the Node.js and Python ones. The full table, with package counts, route coverage and scan times, is in the project README.
The decision
Every vulnerability lands in one of four buckets
One decision per finding, each with a plain-English reason. The set-asides go into an OpenVEX document that auditors and tools such as Dependency-Track accept.
Fix now
An outsider can reach the flawed code, with no login in the way or with exploits already seen in the wild. Fix it before anything else.
Fix next cycle
An outsider can reach the flawed code, but there is a login in the way or no sign that anyone is exploiting it yet. Fix it in the next release.
Watch
The flawed function does run, or sits in the container image, but no outside request reaches it today. NextFix re-checks it against fresh exploit data.
Set aside with evidence
The package is not in the deployed app, or nothing uses it, or the flawed function is never called. Set aside, with a written reason an auditor can read.
How it decides → The three questions, the reachability ladder and why most findings can wait, on one printable page. How it works has the pipeline step by step.
What it reads
Three languages, and the container image
- JavaScript and TypeScript: Express, Fastify and Koa. Lockfiles from npm, yarn and pnpm, workspaces included.
- Python: Flask, FastAPI and Django. Pinned requirements,
Pipfile.lock,poetry.lockanduv.lock. - Go: net/http, Gin, Echo, Chi, Fiber, gorilla/mux and httprouter, from
go.modandgo.sum. - Container images: the operating system's packages (Debian, Ubuntu, Alpine, Wolfi, Chainguard, Red Hat, AlmaLinux, Rocky), the runtime and global tools, plus any CycloneDX or SPDX software bill of materials you already have.
Vulnerability data comes from OSV, exploit probability from FIRST EPSS, and confirmed exploitation from the CISA KEV catalogue. All of it is cached on your machine, and a scan can run offline from the cache.
Who it is for
One page for leadership, one queue for engineers
For leadership
A verdict for the whole application, the funnel from every warning to the ones that matter, what changed since last time, how long open items have waited against the deadline, and which upgrades clear everything. A print button makes a one-page summary. Several applications roll up into a portfolio.
For engineers
The reasons in plain English, the call path from the route to the vulnerable function, the upgrade command, and a GitHub issue or Jira ticket in one click. For pipelines, a build gate, SARIF for GitHub code scanning, and a ready-made Actions workflow.
Where it runs
On your machine or your server, and nothing phones home
NextFix is a program you run yourself. There is no account with GRCSAC, no telemetry and no server of ours. The only outbound traffic is the vulnerability lookups, the fix commits it reads from GitHub to learn which function carries a flaw, and whatever issue tracker or identity provider you choose to connect. Your code never leaves your network.
Teams get accounts and roles, single sign-on with Microsoft Entra ID, Google or Okta, exceptions with an approver and an expiry, scheduled scans, a nightly re-check against new exploit data, and a weekly digest by e-mail, Slack or Teams. All of it is in the same free download.
Only run NextFix on code you own or have permission to assess.