GhostBug

Your app works until it grows

Most bugs do not show up in the test run. They show up at 3 a.m. when traffic spikes, when a second server starts, or when two requests arrive in the same millisecond. Tests pass, CI goes green, and then a user finds the crash.

GhostBug finds those bugs first. Point it at a GitHub repository and it:

Copies the repo into an isolated sandbox. Your real repository is not touched.
Reruns the test suite dozens of times until the rare failure appears.
Shrinks the failure to the fewest steps that still break it, and records the exact order of events.
Asks NVIDIA Nemotron, served through Nebius Token Factory, to work out the cause from the logs and the code, then writes the smallest change it can.
Reruns the fixed test hundreds of times. A fix only counts when the failure stops happening.
If a fix makes things worse, it reverts the fix and tries again, up to five attempts.
Never edits test files. If the bug sits inside a test, it flags that for a person.
Pushes a branch to GitHub only when you say so.

It also looks ahead. The scaling review points out problems that will hit as your app grows, such as a bot that needs sharding before it crashes, so you can act before the crash. The security audit looks for holes that could let someone reach or extract data.

There is also a read only site scanner. Give it a live URL and it checks TLS, security headers, cookies, DNS and email records, secrets in served JavaScript, source maps and exposed files.

What I learned

Hidden bugs are a measurement problem. The hard part was not writing the fix. It was proving the bug exists before touching anything, and proving the fix holds in a way a skeptical reviewer would accept. That is why the rerun counts and the before and after numbers sit at the center of the product.

How I built it

Node, Express and TypeScript on the server. React and Vite on the front end. Tests run with node:test. Reasoning runs on NVIDIA Nemotron through Nebius Token Factory, and research uses Tavily when a key is set. Data lives in Postgres on Supabase. Email and password sign in, with GitHub used for repository access.

Challenges

The sandbox. Docker Desktop hung on my Mac, so I built a host process fallback with its own paths, an egress proxy and memory limits. Docker is still used where it works.
GitHub sign in. The first version opened a popup. GitHub's cross origin policy cut the popup off from the app, so the callback could never report back. Sign in now uses a same tab redirect.
Keeping secrets out of the way. The sandbox hides secret values from the code under test, and the site scanner never receives response bodies.
Trusting the model. Its answers can be wrong, so every fix has to pass the rerun check before it is kept.

Tested on a real codebase

I have already run GhostBug on a codebase with real bugs and tested the results. Next I am running it on more codebases to find where it misses, and which bugs it only catches some of the time.