Hikaflow

Find and fix bugs in Python and TypeScript with one command.

Hikaflow scans your code with 8 engines (Ruff, Bandit, Semgrep, mypy, ESLint, Vulture, npm audit, AST), finds real bugs, and fixes them with AI — syntax-checked and linted before applying.

pip install hikaflow
hikaflow scan

No config needed. No login required for scanning.

What it finds

Security vulnerabilities (SQL injection, XSS, hardcoded secrets, eval usage)
Type errors (wrong argument types, None dereference, missing attributes)
Bugs (missing await, unchecked None, loose equality, empty catch blocks)
Dead code and unused imports
Dependency vulnerabilities (pip-audit, npm audit)
Code smells (bare except, mutable defaults, type coercion)

Quick start

Scan your project

cd your-project
hikaflow scan

Output:

Scanning 142 files...

 CRITICAL  api/auth.py:47       SQL injection via string formatting
 HIGH      payments.ts:23       Missing await on async call
 HIGH      app.tsx:91           User input in dangerouslySetInnerHTML
 MEDIUM    utils.py:12          Bare except clause hides errors
 LOW       config.py:8          Unused import: os

Found 5 issues (1 critical, 2 high, 1 medium, 1 low)

Fix issues with AI

hikaflow scan --fix

Select issues with arrow keys, preview the diff, and apply. Fixes are syntax-checked and linted before applying.

Fix everything at once

hikaflow scan --fix-all

Only scan changed files

hikaflow scan --changed

Generate an HTML report

hikaflow scan --html report.html

Supported languages

Language	Engines
Python	Ruff, Bandit, Semgrep, mypy, Vulture, pip-audit, 13 AST specialists
TypeScript / JavaScript	ESLint, Semgrep, npm audit, 6 tree-sitter specialists

Configuration

Create .hikaflow.yml in your project root to suppress rules or paths:

ignore_rules:
  - hardcoded-secret    # Suppress specific rules
  - unused-import

ignore_paths:
  - "vendor/*"          # Skip vendored code
  - "*.test.ts"         # Skip test files
  - "migrations/*"

CI integration

hikaflow ci-setup

This generates:

.github/workflows/hikaflow.yml — GitHub Action that runs on every PR
.hikaflow.yml — default config
Pre-commit hook (optional)

Or add manually to your workflow:

- name: Install Hikaflow
  run: pip install hikaflow

- name: Scan for bugs
  run: hikaflow scan --json > hikaflow-results.json

- name: Fail on critical issues
  run: hikaflow scan --exit-code

AI fixes (free tier)

Scanning is free and unlimited. AI fixes require a free account:

hikaflow login
hikaflow scan --fix

Plan	AI fixes / month	Price
Free	5	$0
Pro	100	$19/mo
Team	1,000	$49/mo

Commands

Command	Description
`hikaflow scan`	Scan code for bugs and security issues
`hikaflow scan --fix`	Interactive AI fix mode
`hikaflow scan --fix-all`	Fix all issues automatically
`hikaflow scan --changed`	Only scan git-changed files
`hikaflow scan --html out.html`	Generate HTML report
`hikaflow ci-setup`	Generate CI config and pre-commit hooks
`hikaflow login`	Authenticate (required for AI fixes)
`hikaflow doctor`	Check environment and dependencies

Requirements

Python 3.9+
Node.js (optional, for ESLint/npm audit on JS/TS projects)

License

Metadata

Release files for hikaflow 2.5.13

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for hikaflow 2.5.13
File	Size	Uploaded	Provenance
hikaflow-2.5.13.tar.gz	1.4 MB	Mar 10, 2026	Without provenance	Details

Built distribution (wheel)

Table of built distributions (wheels) for hikaflow 2.5.13
File	Interpreter	ABI	Platform	Reset
hikaflow-2.5.13-py3-none-any.whl 1.3 MB Mar 10, 2026 Without provenance	Python 3	none	any	Details

Total release size: 2.6 MB

Release files / hikaflow-2.5.13.tar.gz

Download URL	hikaflow-2.5.13.tar.gz
Size	1.4 MB
Tags	Source
SHA-256 checksum How to use checksums	`b8bb5695a64f0e84bb29be09c0d9dcd40ae4686fc0104e167a80153197adb4bd`
BLAKE2b-256 checksum How to use checksums	`1bc18b514440c5d3dab0878acad62d65b65a1ed52299e0597c5d95fe2deceb4e`
Upload date	Mar 10, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.13.11`

Release files / hikaflow-2.5.13-py3-none-any.whl

Download URL	hikaflow-2.5.13-py3-none-any.whl
Size	1.3 MB
Tags	Python 3
SHA-256 checksum How to use checksums	`f1f4b07751d5e45eefd67e932e34f6e46eff39d72d56a53ec88744237a5753cb`
BLAKE2b-256 checksum How to use checksums	`4608b084fb05a26251f6fad4631ccfa451d2a6187ac1960e5c4bd93258cc2c03`
Upload date	Mar 10, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.13.11`

Security for hikaflow 2.5.13

Report project as malware

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.