Auto-Fix Overview

The three fix levels, coverage, and the safety features that protect your server.

StackSentry can apply security fixes directly to your server and configuration files. This page explains what gets fixed automatically, what requires manual action, and how to use the engine safely.

Three Levels of Fix Output

Level 1 — Code Snippets (APP layer)

Application-layer checks cannot be fixed via SSH because the fix lives inside your application code. For these, StackSentry prints stack-aware code snippets — the exact code to add to your Flask, Django, Laravel, or PHP application.

Level 2 — Patch Files (`--patch`)

StackSentry writes executable fix scripts to patches/{target}_{date}_scan{N}/:

.sh — Shell scripts for host and webserver fixes (dry-run guards included)
.conf — nginx configuration snippets
.py — Python scripts for Flask/Django fixes
.php — PHP scripts for PHP application fixes
README.md — Severity-sorted application order
manifest.json — Machine-readable metadata

Level 3 — Direct Auto-Fix (`--fix`)

The auto-fix engine connects via SSH and applies fixes directly, validating each change before confirming it. This is the fastest path from F to C.

Auto-Fix Coverage Summary

Layer	Check	Method
HOST	HOST-SSH-001	✅ SSH (with key pre-flight)
HOST	HOST-FW-001	✅ SSH
HOST	HOST-UPDATE-001	✅ SSH
HOST	HOST-PERM-001	✅ SSH
HOST	HOST-LOG-001	✅ SSH
WS	WS-HSTS-001	✅ SSH or `--nginx-conf`
WS	WS-SEC-001	✅ SSH or `--nginx-conf`
WS	WS-TLS-001	✅ SSH or `--nginx-conf`
WS	WS-SRV-001	✅ SSH or `--nginx-conf`
WS	WS-DIR-001	✅ SSH or `--nginx-conf`
WS	WS-LIMIT-001	✅ SSH or `--nginx-conf`
CONT	CONT-USER-001	✅ `--dockerfile`
CONT	CONT-CONF-HEALTH	✅ `--dockerfile`
CONT	CONT-RES-001	✅ `--compose-file`
CONT	CONT-COMP-RES	✅ `--compose-file`
APP	All APP checks	📋 Code snippet

Safety Features

Every automated fix includes:

Validation before applying — nginx -t or sshd -t runs before reloading
Timestamped backup — original files are backed up before modification
Idempotency — running fix twice produces the same result
Cascade abort — if nginx validation fails, subsequent webserver fixes are skipped If any fix fails validation, the auto-fix engine stops that fix chain, reports exactly what went wrong, and moves on to independent fixes. It never leaves your server in a broken state without telling you.

nginx Configuration Cascade Protection

A shared _nginx_config_broken flag tracks whether any nginx fix in the current session caused a failed nginx -t validation. If this flag is set, all subsequent webserver-layer fixes return skipped with an explanatory message rather than attempting further changes.

This prevents a scenario where one bad nginx snippet causes multiple unrelated checks to report failure.