VaultTester: Secure AI Bug Reporter

An AI QA assistant that formats raw bug reports and securely publishes them to GitHub using Auth0 Token Vault, eliminating the need for hardcoded Personal Access Tokens.

Comment

💡 Inspiration

The idea for VaultTester came from a glaring security flaw in how most AI agents interact with external platforms like GitHub. Traditionally, to let an AI create a bug report, developers force users to generate Personal Access Tokens (PATs) and paste them into the app. These tokens are often over-privileged, have long lifespans, and are terrifyingly vulnerable if the frontend or database is compromised. We wanted to build a QA assistant that is fully autonomous but operates with zero hardcoded tokens.

🔗 Live Published Application: https://vault-tester.vercel.app/

⚙️ What it does

VaultTester is a Secure AI Bug Reporter. A QA tester or user can paste a raw, informal complaint (e.g., "the login button spins and freezes"). The application uses Google Gemini 3 Flash to format this into a professional, industry-standard Markdown issue.

But here is the enterprise feature: Before publishing, VaultTester dynamically fetches the user's live GitHub repositories, available assignees, and labels. The lead developer can perform full triage right from the dashboard, and publish the issue securely to GitHub.

🛠️ How we built it

The application is built on Next.js (App Router) with Tailwind CSS. We used Auth0 for identity management and Google Gemini for the AI layer. The entire application is deployed on Vercel.

🏆 BONUS BLOG POST SUBMISSION: Eliminating PATs with Auth0 Token Vault

This section is our submission for the Bonus Blog Post Prize.

When building agentic AI applications that interact with third-party APIs, the industry standard has sadly become asking users to hand over their Personal Access Tokens (PATs). As a developer, storing and managing these tokens securely is a nightmare. For our hackathon project, VaultTester, we set out to prove that AI agents can be "Authorized to Act" without ever touching a user's raw credentials.

The Implementation Journey We completely eliminated PATs by integrating the Auth0 for AI Agents Token Vault. Our implementation journey followed a strict, secure architecture:

  1. Consent Delegation: We utilized Auth0's Universal Login with Social Connections (GitHub). During login, the user explicitly grants VaultTester permission to access their repositories.
  2. Secure Vaulting: Once authenticated, the GitHub IdP access token is securely locked away inside the Auth0 Token Vault. It is never sent to the browser, eliminating XSS vulnerabilities.
  3. Machine-to-Machine (M2M) Retrieval: When the Gemini AI finishes formatting the bug report, our Next.js backend (acting as a secure confidential client) communicates directly with the Auth0 Management API via an M2M connection.
  4. Parallel Execution: Our server retrieves the Vaulted token and immediately executes parallel fetches to the GitHub REST API to retrieve dynamic repository metadata (labels and assignees) for triage.
  5. Secure Action: The finalized payload is pushed to GitHub using the vaulted token entirely server-side.

The Impact By leveraging the Token Vault, we solved the hardest part of AI agency: secure authorization. VaultTester demonstrates that we can build complex, multi-step AI agents that respect user boundaries. The developer experience provided by the Auth0 Management API SDK allowed us to focus on the AI logic rather than reinventing a secure credential storage system. We successfully created an agent that is powerful, dynamic, and mathematically secure.

🚧 Challenges we ran into

Integrating the Auth0 Management API to extract the IdP token required a deep understanding of M2M flows. Ensuring that the callback URLs exactly matched between Auth0 and our Next.js deployment (especially during Vercel deployment) was a strict hurdle that taught us a lot about Auth0's unyielding security posture.

🚀 What's next for VaultTester

We plan to expand the AI's capabilities to automatically suggest code fixes alongside the bug reports, and integrate Auth0 step-up authentication before allowing the AI to close or delete issues on GitHub.

Built With

Share this project:

Updates

Submission history