Architecture, end to end
How GateTest works
122 deterministic modules. A model is called only to generate a fix, and only when a replayed recipe does not already solve the shape.
Most QA scanners are either purely pattern-matched (cheap, noisy) or purely LLM-driven (expensive, unpredictable). GateTest is neither. The default scan is a static engine with no AI in the loop — predictable, reproducible, no surprise API spend. AI is reserved for fix generation, and even there a proven recipe replays first — the AI layer is only called for a shape it has not solved before.
The pipeline
Customer push hits one of two ingress points, lands in a single Postgres queue, runs the gate, and ships a PR. The same path serves every tier — depth comes from what we layer on top, not from a different pipeline.
The diagram is hand-rolled SVG. Mermaid would have required adding a dependency, and the rule on unapproved dependencies is hard.
The 122 modules
Each module is self-contained, runs in parallel, and emits structured findings. Click a card to see a representative finding. Grouped by category for browsability — the actual suite assignment lives in src/core/config.js.
122 modules total. Every Full scan ($99) runs the developer suite. URL scans run the live-site subset. Quick scan runs the highest-signal four.
Source & quality13 modules
The foundation. Catches the bugs every linter and compiler should have caught but didn't.
syntaxValidates JS, TS, JSON, YAML, CSS, HTML.
Validates JS, TS, JSON, YAML, CSS, HTML.
Unclosed bracket at src/api/handler.ts:148lintESLint, Stylelint, language-aware style rules.
ESLint, Stylelint, language-aware style rules.
Unexpected console statement at src/db.ts:42codeQualityconsole.log, debugger, TODO/FIXME, eval, innerHTML, complexity.
console.log, debugger, TODO/FIXME, eval, innerHTML, complexity.
innerHTML assignment found at components/Comment.tsx:88deadCodeUnused exports across JS/TS/Python, orphaned files, rotting commented-out blocks.
Unused exports across JS/TS/Python, orphaned files, rotting commented-out blocks.
Export 'parseLegacyToken' in src/auth.ts has no importerstypescriptStrictnesstsconfig regressions, @ts-ignore abuse, any-leak detection on exported signatures.
tsconfig regressions, @ts-ignore abuse, any-leak detection on exported signatures.
strict: false in tsconfig.json — implicit-any leaks across 47 filesdocumentationREADME, CHANGELOG, LICENSE, JSDoc coverage, env documentation.
README, CHANGELOG, LICENSE, JSDoc coverage, env documentation.
Missing README section: InstallationduplicateCodeCopy-pasted blocks that should be extracted into utilities.
Copy-pasted blocks that should be extracted into utilities.
16-line block duplicated 4x across src/handlers/importCycleCircular dependencies that cause runtime TDZ / undefined-import bugs.
Circular dependencies that cause runtime TDZ / undefined-import bugs.
Cycle: src/user.ts → src/post.ts → src/user.tsspineHealthStructural analysis of the dependency graph — what the codebase costs to change. Load-bearing files that are untested, god files, layering violations, and the direction coupling is trending.
Structural analysis of the dependency graph — what the codebase costs to change. Load-bearing files that are untested, god files, layering violations, and the direction coupling is trending.
fragile-spine: src/core/registry.js — 230 files depend on it, no direct testasyncIterationAsync callbacks handed to .reduce/.filter/.some/.every/.forEach/.map where Promise semantics silently break.
Async callbacks handed to .reduce/.filter/.some/.every/.forEach/.map where Promise semantics silently break.
.filter(async x => await isValid(x)) — predicate is a Promise, always truthydatetimeBugNaive datetimes, JS 0-vs-1 month, moment-legacy.
Naive datetimes, JS 0-vs-1 month, moment-legacy.
datetime.now() without tz= at jobs/scheduler.py:31moneyFloatIEEE-754 precision loss on currency-named variables.
IEEE-754 precision loss on currency-named variables.
parseFloat(amount) on trust-account money in TrustActions.tsxhomoglyphTrojan Source bidi overrides, Cyrillic/Greek letters in Latin identifiers, zero-width chars.
Trojan Source bidi overrides, Cyrillic/Greek letters in Latin identifiers, zero-width chars.
Cyrillic 'а' (U+0430) inside identifier `data` at src/parser.ts:212Security15 modules
OWASP-grade scanning that goes beyond CVE lookups into your actual code paths.
securityOWASP patterns, XSS, SQL injection, innerHTML, shell exec, Docker misconfigs.
OWASP patterns, XSS, SQL injection, innerHTML, shell exec, Docker misconfigs.
exec(req.body.cmd) at api/run.ts:54 — command injectionsecretsAWS keys, GitHub tokens, Stripe keys, passwords, private keys, DB strings.
AWS keys, GitHub tokens, Stripe keys, passwords, private keys, DB strings.
AKIA[redacted] hardcoded in config/aws.tssecretRotationLong-lived credentials in git, .env drift, placeholder/real example mismatch.
Long-lived credentials in git, .env drift, placeholder/real example mismatch.
API_KEY in .env has been unchanged for 412 daysssrfUser-controlled URLs handed to fetch/axios/got/node-http without validation.
User-controlled URLs handed to fetch/axios/got/node-http without validation.
fetch(req.query.url) with no allowlist at api/proxy.ts:18tlsSecurityrejectUnauthorized:false, verify=False, NODE_TLS_REJECT_UNAUTHORIZED=0.
rejectUnauthorized:false, verify=False, NODE_TLS_REJECT_UNAUTHORIZED=0.
rejectUnauthorized: false in production https.AgentcookieSecurityhttpOnly:false, weak session secrets, SESSION_COOKIE_* misconfigs.
httpOnly:false, weak session secrets, SESSION_COOKIE_* misconfigs.
session cookie httpOnly: false — XSS becomes session takeoverredosCatastrophic-regex detector: nested quantifiers, overlapping alternation, user-controlled patterns.
Catastrophic-regex detector: nested quantifiers, overlapping alternation, user-controlled patterns.
(a+)+ at src/validator.ts:30 — catastrophic backtrackingauthBypassRoutes missing authentication.
Routes missing authentication.
/api/admin/users has no middleware guardcrossFileTaintCross-file taint analysis — user input → dangerous sinks across module boundaries.
Cross-file taint analysis — user input → dangerous sinks across module boundaries.
req.body.path → fs.readFile via 3 hops, no validationwebhookPayloadWebhook handlers that use req.body without validation.
Webhook handlers that use req.body without validation.
Stripe webhook handler reads req.body.amount without zod parselogPiiCredentials, tokens, and request objects logged in plaintext.
Credentials, tokens, and request objects logged in plaintext.
console.log(user) at auth/login.ts:88 — leaks bcrypt hashwpExposedFilesWordPress: sensitive files exposed via public webroot (wp-config.php.bak, debug.log, .git, .env, SQL backups).
WordPress: sensitive files exposed via public webroot (wp-config.php.bak, debug.log, .git, .env, SQL backups).
wp-config.php.bak reachable at /wp-config.php.bak (HTTP 200)wpXmlrpcExposedWordPress: /xmlrpc.php exposed (brute-force amplification + DDoS reflector + auth-bypass surface).
WordPress: /xmlrpc.php exposed (brute-force amplification + DDoS reflector + auth-bypass surface).
/xmlrpc.php returns 200 — disable or block at WAFwpMalwarePatternsWordPress: rendered HTML/JS scanned for known malware signatures (eval(atob), hidden iframes, base64 payloads).
WordPress: rendered HTML/JS scanned for known malware signatures (eval(atob), hidden iframes, base64 payloads).
eval(atob(...)) found in footer script — likely compromisedwpAdminProtectionWordPress: /wp-admin and /wp-login.php checked for rate limit / WAF / 2FA / cookie hardening.
WordPress: /wp-admin and /wp-login.php checked for rate limit / WAF / 2FA / cookie hardening.
/wp-login.php has no rate limiting — brute-force openReliability11 modules
The bugs that don't break on your machine but break in production at 3am.
errorSwallowEmpty catch, .catch(noop), callback-err ignored, floating promises, global silent handlers.
Empty catch, .catch(noop), callback-err ignored, floating promises, global silent handlers.
Empty catch block at db/save.ts:114 — error swallowednPlusOneDatabase calls inside loops across Prisma, Sequelize, TypeORM, Mongoose, Knex, Drizzle.
Database calls inside loops across Prisma, Sequelize, TypeORM, Mongoose, Knex, Drizzle.
await prisma.post.findUnique inside arr.map at feed.ts:42retryHygieneTight retry loops, no backoff, unbounded retry, retry-on-4xx across fetch/axios/got/node-http.
Tight retry loops, no backoff, unbounded retry, retry-on-4xx across fetch/axios/got/node-http.
while(true) retry with no jitter at api/upload.ts:88raceConditionTOCTOU, get-or-create anti-pattern, lost-update on counters.
TOCTOU, get-or-create anti-pattern, lost-update on counters.
fs.exists() then fs.unlink() — same path, symlink-race vectorresourceLeakUnclosed streams, file handles, intervals, sockets across fs/net/ws/events.
Unclosed streams, file handles, intervals, sockets across fs/net/ws/events.
fs.createReadStream never piped or closed at importer.ts:31envVarsprocess.env / os.environ reads cross-referenced with .env.example and CI env blocks.
process.env / os.environ reads cross-referenced with .env.example and CI env blocks.
STRIPE_SECRET_KEY read in code but missing from .env.examplecronExpressionInvalid / impossible / too-frequent cron strings (Feb 30, * * * * *, typo aliases).
Invalid / impossible / too-frequent cron strings (Feb 30, * * * * *, typo aliases).
0 0 30 2 * — Feb 30 never fires, silent killerfeatureFlagStale flags collapsed into constants and dead-branch conditionals.
Stale flags collapsed into constants and dead-branch conditionals.
if (true) wrapping 200 lines of code at src/checkout.ts:14intentVerificationAI checks that the diff matches the commit message / PR description.
AI checks that the diff matches the commit message / PR description.
PR titled 'fix typo' touches 18 files across 3 directoriesregressionPredictorAI predicts which files this PR is most likely to break.
AI predicts which files this PR is most likely to break.
Confidence 87%: this change will break tests in checkout/rollbackHonestyRollback Honesty Checker — verifies advertised rollback path actually rolls back.
Rollback Honesty Checker — verifies advertised rollback path actually rolls back.
deploy.sh has no rollback function despite docs claiming oneWeb & UX23 modules
Surfacing the user-visible problems static analysis usually pretends don't exist.
accessibilityWCAG 2.2 automated audit (AA + AAA-aligned) — missing alt text, ARIA labels, keyboard traps, heading hierarchy.
WCAG 2.2 automated audit (AA + AAA-aligned) — missing alt text, ARIA labels, keyboard traps, heading hierarchy.
Heading skip h1 → h3 at /pricing (WCAG 1.3.1)performanceDependency count, bundle size analysis, image optimisation checks.
Dependency count, bundle size analysis, image optimisation checks.
Hero image 3.4MB unoptimised — LCP penaltyvisualVisual & UI Regression Testing.
Visual & UI Regression Testing.
Hero CTA shifted 14px between deploysseoMeta tags, Open Graph, structured data, robots.txt, canonical URLs.
Meta tags, Open Graph, structured data, robots.txt, canonical URLs.
Missing canonical on /compare/snyklinksEvery broken href — dead anchors, placeholder links, 404s.
Every broken href — dead anchors, placeholder links, 404s.
/docs/guide returns 404 from footer linkcompatibilityBrowser matrix validation. Modern API and CSS features without polyfills.
Browser matrix validation. Modern API and CSS features without polyfills.
:has() selector at safari < 15.4 — partial supporte2eEnd-to-End Test Execution.
End-to-End Test Execution.
Checkout flow times out at payment stepliveCrawlerLive site crawl — 404 / 500 / broken-image / redirect-chain on the live URL.
Live site crawl — 404 / 500 / broken-image / redirect-chain on the live URL.
/blog/old-post → 3 redirects → 404explorerAutonomous Interactive Element Explorer — drives a real browser to click every button + form + dropdown.
Autonomous Interactive Element Explorer — drives a real browser to click every button + form + dropdown.
Submit button on /signup raises uncaught TypeErrorruntimeErrorsLive browser runtime errors — uncaught JS, console.error/warn, network 4xx/5xx, CSP violations, hydration mismatches.
Live browser runtime errors — uncaught JS, console.error/warn, network 4xx/5xx, CSP violations, hydration mismatches.
Hydration mismatch: server rendered 'Dec', client rendered 'Jan'visualRegressionFull-page screenshot diffing at desktop + mobile widths against a stored baseline — catches redesigns and broken layouts no DOM check can see.
Full-page screenshot diffing at desktop + mobile widths against a stored baseline — catches redesigns and broken layouts no DOM check can see.
18.4% of pixels changed on /pricing (mobile) — exceeds 5% thresholdinteractiveElementsLive link + button crawler — HTTP-verifies every internal link, click-tests every button with a destructive-action skip list (delete/cancel/logout never fire) and modal cleanup between clicks.
Live link + button crawler — HTTP-verifies every internal link, click-tests every button with a destructive-action skip list (delete/cancel/logout never fire) and modal cleanup between clicks.
DEAD BUTTON: "Subscribe" on /pricing — clicked but nothing happenedapiHealthHits every discovered API endpoint with valid + missing-parameter requests — checks status codes, response time, and JSON vs HTML content-type.
Hits every discovered API endpoint with valid + missing-parameter requests — checks status codes, response time, and JSON vs HTML content-type.
POST /graphql returned HTML instead of JSON — middleware or auth redirect intercepting the routeperformanceBudgetLive TTFB / LCP / CLS / page-weight budget check against a real URL — median of 3 runs with a cold-start warm-up first.
Live TTFB / LCP / CLS / page-weight budget check against a real URL — median of 3 runs with a cold-start warm-up first.
LCP 4120ms > 2500ms budget on /dashboard — unoptimised hero imagemobileRenderingHorizontal-overflow and unreadable-text checks across 5 device widths (390/414/768/1024/1280) — absolute checks, not a diff.
Horizontal-overflow and unreadable-text checks across 5 device widths (390/414/768/1024/1280) — absolute checks, not a diff.
63px horizontal overflow at 1024px (laptop) — fixed-width element wider than the viewportformTestingFills and submits every SAFE form (contact, newsletter, search, feedback) and verifies a real success signal. Payment-shaped, auth-shaped, and CAPTCHA-protected forms are detected and skipped — never submitted or bypassed.
Fills and submits every SAFE form (contact, newsletter, search, feedback) and verifies a real success signal. Payment-shaped, auth-shaped, and CAPTCHA-protected forms are detected and skipped — never submitted or bypassed.
Contact form on /support accepts input but nothing happens on submit — silent failureconsoleErrorsSite-wide crawl aggregating console errors/warnings across every page visited — fingerprints and dedupes the same error across pages, flags errors that fire on every page as systemic.
Site-wide crawl aggregating console errors/warnings across every page visited — fingerprints and dedupes the same error across pages, flags errors that fire on every page as systemic.
CSP blocks Google Fonts on every one of 5 crawled pages — persistent, site-widedesignSystemComplianceAudits live computed styles for near-duplicate colors, off-grid spacing, and type-scale drift — catches design-token erosion no pixel diff or source lint sees.
Audits live computed styles for near-duplicate colors, off-grid spacing, and type-scale drift — catches design-token erosion no pixel diff or source lint sees.
52 distinct colors in use, 20 recommended — palette drifting from shared tokenscrossBrowserRuns the same page load across Chromium, Firefox, and WebKit and diffs navigation success, runtime errors, and rendering against Chromium as the reference engine.
Runs the same page load across Chromium, Firefox, and WebKit and diffs navigation success, runtime errors, and rendering against Chromium as the reference engine.
Firefox throws a CSP error Chromium doesn't — engine-specific bugchaosChaos & Resilience Testing — slow network, API failure, offline, missing resources, server timeouts. Runs via the GitHub Action where a headless browser is available; the website-only Forensic scan does not include it.
Chaos & Resilience Testing — slow network, API failure, offline, missing resources, server timeouts. Runs via the GitHub Action where a headless browser is available; the website-only Forensic scan does not include it.
App freezes on 3G simulation — no loading state shownwebHeadersCSP/HSTS/XFO/CORS misconfig across Next.js, Vercel, Netlify, nginx, Apache, Caddy and server source in any language.
CSP/HSTS/XFO/CORS misconfig across Next.js, Vercel, Netlify, nginx, Apache, Caddy and server source in any language.
CSP missing — defaults to inline-everythingestateEvery host the target owns — list, sitemap, TLS SAN, links — each given an outside-in verdict.
Every host the target owns — list, sitemap, TLS SAN, links — each given an outside-in verdict.
api.example.com: gateway-up-app-dead (502)cacheHeadersCache Headers & CDN Configuration.
Cache Headers & CDN Configuration.
/api/user has Cache-Control: public — PII cacheable at CDNInfrastructure19 modules
Catches the supply-chain takeovers, container exploits, and CI/CD foot-guns.
dependenciesSupply-chain hygiene across npm, pip, Pipenv, Poetry, go.mod, Cargo, Bundler, Composer, Maven, Gradle.
Supply-chain hygiene across npm, pip, Pipenv, Poetry, go.mod, Cargo, Bundler, Composer, Maven, Gradle.
left-pad in package.json pinned to 'latest' — supply-chain riskdockerfileRoot user, :latest tags, curl|sh, apt hygiene, secrets-in-layers, cache bloat.
Root user, :latest tags, curl|sh, apt hygiene, secrets-in-layers, cache bloat.
USER not set — container runs as rootciSecurityGitHub Actions hardening — action pinning, pwn-request, shell injection, secrets-in-logs, permissions.
GitHub Actions hardening — action pinning, pwn-request, shell injection, secrets-in-logs, permissions.
actions/checkout@v4 unpinned to SHA — supply-chain riskciParamValidatorValidates GitHub Actions with: inputs against action schemas.
Validates GitHub Actions with: inputs against action schemas.
actions/upload-artifact: invalid input 'retention' (typo of 'retention-days')shellShell script security — curl|sh, unsafe rm, eval injection, hardcoded secrets, set -e, POSIX compliance.
Shell script security — curl|sh, unsafe rm, eval injection, hardcoded secrets, set -e, POSIX compliance.
rm -rf $VAR with no quoting at scripts/clean.sh:14bashSafetyBash / Shell Error-Swallow Detector.
Bash / Shell Error-Swallow Detector.
Pipeline lacks set -o pipefail — silent failuresqlMigrationsDrop column/table, non-concurrent indexes, NOT NULL without default, blocking constraints, rolling-deploy renames.
Drop column/table, non-concurrent indexes, NOT NULL without default, blocking constraints, rolling-deploy renames.
ALTER TABLE users ADD COLUMN email NOT NULL — blocks writesterraformPublic buckets, wildcard ingress, hardcoded secrets, missing encryption, IAM wildcards.
Public buckets, wildcard ingress, hardcoded secrets, missing encryption, IAM wildcards.
aws_s3_bucket.acl = 'public-read' on customer-data bucketkubernetesPrivileged pods, host namespaces, :latest images, missing limits/probes, dangerous caps.
Privileged pods, host namespaces, :latest images, missing limits/probes, dangerous caps.
privileged: true in production deploymentsystemdSystemd Unit File Validator.
Systemd Unit File Validator.
Service has no Restart= policy — won't recover from crashdeployScriptValidatorHealth-check URL consistency.
Health-check URL consistency.
deploy.sh checks :3000 but service listens on :8080serviceConsistencyExecStart / Procfile / PM2 vs package.json start script.
ExecStart / Procfile / PM2 vs package.json start script.
Procfile runs `node dist/server.js`, package.json runs `node server.js`deployContractDeploy Contract Validator.
Deploy Contract Validator.
Vercel runtime=edge but route uses fs moduledeployReadinessAggregate 0-100 deployment confidence score.
Aggregate 0-100 deployment confidence score.
Deploy readiness: 62/100 — 3 critical, 8 high opennativeBundlerGuardNative Node addons that cannot be bundled.
Native Node addons that cannot be bundled.
import sharp — native binary not bundleable on Vercel edgebundleSizeJS bundles exceeding size budgets.
JS bundles exceeding size budgets.
main.js 412 KB gzip — budget is 200 KBenvIntegrityEnv-File Integrity Linter.
Env-File Integrity Linter.
.env has duplicate STRIPE_KEY entries — last wins silentlypromptSafetyBrowser-exposed API keys, unbounded max_tokens, prompt-injection surfaces, deprecated models.
Browser-exposed API keys, unbounded max_tokens, prompt-injection surfaces, deprecated models.
Client-bundled NEXT_PUBLIC_* credential shipped to every visitorsbomGenerates a CycloneDX 1.4 Software Bill of Materials from your lockfile — the artifact procurement and compliance teams ask for.
Generates a CycloneDX 1.4 Software Bill of Materials from your lockfile — the artifact procurement and compliance teams ask for.
SBOM generated: 214 components, 3 GPL-licensed, 1 EOL package flaggedDeveloper hygiene10 modules
Pulls bad-process bugs out of CI before they cost a 90-minute review.
prSizeBlocks unreviewably-large pull requests (files / lines / sprawl across top-level dirs).
Blocks unreviewably-large pull requests (files / lines / sprawl across top-level dirs).
PR touches 142 files, 3,400 lines across 6 top-level dirsprQualityWeak commit messages, missing tests, mixed deps+code.
Weak commit messages, missing tests, mixed deps+code.
Commit message 'fix' on a 200-line changeflakyTestsCommitted .only/.skip, real clock/network/timers, env leaks, self-admitted flakes. When the engine runs your tests it also records each test per run: one that flips is quarantined as a warning for 14 days, then blocks again unless fixed.
Committed .only/.skip, real clock/network/timers, env leaks, self-admitted flakes. When the engine runs your tests it also records each test per run: one that flips is quarantined as a warning for 14 days, then blocks again unless fixed.
describe.only( found in tests/checkout.test.tsfakeFixDetectorAI-generated symptom patches — skipped tests, swallowed errors, dead code.
AI-generated symptom patches — skipped tests, swallowed errors, dead code.
Test changed from expect(x).toBe(2) to .toBe.any() — patching test, not bughardcodedUrllocalhost / 127.0.0.1 / RFC1918 / internal TLDs / non-TLS URLs leaking into production.
localhost / 127.0.0.1 / RFC1918 / internal TLDs / non-TLS URLs leaking into production.
A dev URL (loop-back, RFC1918, internal TLD) shipped into the production bundleopenapiDriftRoutes defined in code missing from openapi.yaml, and spec paths with no matching handler.
Routes defined in code missing from openapi.yaml, and spec paths with no matching handler.
GET /api/v2/orders defined in code but absent from spectrpcContracttRPC procedure definitions vs frontend call sites.
tRPC procedure definitions vs frontend call sites.
Frontend calls trpc.user.delete — procedure removed in servermonorepoConstraintsEnforces package boundary rules in apps/ packages/ libs/.
Enforces package boundary rules in apps/ packages/ libs/.
apps/web imports from apps/admin — boundary violationzodSchemaPresenceReact components without runtime prop validation.
React components without runtime prop validation.
<Checkout> exported with no zod parse on prop inputdataIntegrityMigration safety, SQL injection patterns, PII in logs, database schema validation.
Migration safety, SQL injection patterns, PII in logs, database schema validation.
Migration drops column 'email' with no backfillAI & advanced9 modules
Where deterministic scanning stops and reasoning starts. Used sparingly, not by default.
aiReviewAI reads your code and finds real bugs — not patterns, actual understanding.
AI reads your code and finds real bugs — not patterns, actual understanding.
Token refresh races with logout — second auth call uses dead tokenagenticMemory-driven AI investigation — picks hypotheses from past scans, walks the code.
Memory-driven AI investigation — picks hypotheses from past scans, walks the code.
Recurring null-deref in user.profile — root cause traced to login flowmemoryCodebase memory — compounding intelligence across scans (issue history + fix patterns).
Codebase memory — compounding intelligence across scans (issue history + fix patterns).
This file had 14 prior findings — focus areas: auth, sessionaiHallucinationFake imports, invented APIs, non-existent methods.
Fake imports, invented APIs, non-existent methods.
An import named { useFoo } from a library that has no such exportclaudeComplianceAI-output rot — mock data in prod, not-implemented stubs, WHAT-not-WHY comment noise, `any` / `@ts-ignore` density.
AI-output rot — mock data in prod, not-implemented stubs, WHAT-not-WHY comment noise, `any` / `@ts-ignore` density.
John Doe placeholder in src/users.ts:42 — mock data shipped to produndefinedRefVariables, functions, methods referenced before they're defined.
Variables, functions, methods referenced before they're defined.
ReferenceError: handleClick is not defined at line 47 — typo'd from handeClickarchitectureDriftAI flags code that violates documented architectural conventions.
AI flags code that violates documented architectural conventions.
src/api/orders.ts bypasses repository layer — direct DB accessmutationModifies your source code to verify your tests actually catch bugs. Runs via the GitHub Action because it executes your test suite; the website-only Forensic scan does not include it.
Modifies your source code to verify your tests actually catch bugs. Runs via the GitHub Action because it executes your test suite; the website-only Forensic scan does not include it.
Mutated return true → return false, 11/11 tests still passaiGuardrailsAdversarial LLM testing — 30 scenarios across jailbreak, prompt injection, PII leak, hallucination, tool exfil, cost control. Forensic tier; requires your endpoint URL + auth.
Adversarial LLM testing — 30 scenarios across jailbreak, prompt injection, PII leak, hallucination, tool exfil, cost control. Forensic tier; requires your endpoint URL + auth.
Endpoint leaked system prompt under role-play jailbreak scenario 4Scanning & testing2 modules
The classic suite — unit, integration, end-to-end — wired into the same gate as everything else.
unitTestsUnit Test Execution.
Unit Test Execution.
tests/cart.test.ts: 14 failed, 218 passed, 0 skippedintegrationTestsIntegration Test Execution.
Integration Test Execution.
Order placement → payment → fulfilment: 1 failure at fulfilment stepLanguage coverage9 modules
Nine non-JS language backends. Same engine, language-aware patterns.
pythoneval/exec, bare-except, SQL injection, pickle.
eval/exec, bare-except, SQL injection, pickle.
pickle.loads(request.data) at api/users.py:12 — RCE vectorgoIgnored errors, panics, goroutine hygiene.
Ignored errors, panics, goroutine hygiene.
_, err := db.Query(...) — err discarded at db.go:88rustunwrap/panic/todo, unsafe block review.
unwrap/panic/todo, unsafe block review.
.unwrap() on Option in production code at src/auth.rs:24javaSystem.out, broad catches, empty catches.
System.out, broad catches, empty catches.
catch (Exception e) {} at OrderService.java:301rubyeval, shell injection, bare rescue.
eval, shell injection, bare rescue.
system("convert #{input}") — shell injection at uploader.rb:18phpeval, legacy mysql_, XSS, debug output.
eval, legacy mysql_, XSS, debug output.
mysql_query() deprecated API at legacy/db.php:42csharpConsole.WriteLine, empty catches.
Console.WriteLine, empty catches.
Empty catch in OrderController.cs:189 — exception swallowedkotlin!!, TODO(), println.
!!, TODO(), println.
user.profile!! at HomeFragment.kt:71 — NPE riskswiftfatalError, try!, force-unwrap.
fatalError, try!, force-unwrap.
try! JSONDecoder().decode(...) in production at Network.swift:23WordPress6 modules
Live-URL probes for the WordPress health check at /wp. Run against any public WordPress site.
wpVersionLeakWhere the site leaks its core version (readme.html, meta generator, RSS feed, CSS/JS ver=).
Where the site leaks its core version (readme.html, meta generator, RSS feed, CSS/JS ver=).
Meta generator: 'WordPress 5.8.1' — readable from view-sourcewpPluginCveCheckDetects installed plugins via fingerprinting and flags any with known CVEs.
Detects installed plugins via fingerprinting and flags any with known CVEs.
elementor 3.5.2 detected — CVE-2023-XXXX criticalwpUserEnumerateChecks if usernames can be enumerated via /?author=1, /wp-json/wp/v2/users, /author/admin/.
Checks if usernames can be enumerated via /?author=1, /wp-json/wp/v2/users, /author/admin/.
/?author=1 reveals login 'admin' via redirectwpPhpVersionEolDetects the running PHP version and flags it if end-of-life.
Detects the running PHP version and flags it if end-of-life.
PHP 7.4 detected — EOL since 2022, no security patcheswpThemeAbandonmentDetects the active theme and flags it if abandoned, deprecated, or carrying known CVEs.
Detects the active theme and flags it if abandoned, deprecated, or carrying known CVEs.
Theme 'oldtheme' last updated 2019 — abandonedwpBackupValidationWhether a backup plugin is installed AND whether any backup files are publicly exposed.
Whether a backup plugin is installed AND whether any backup files are publicly exposed.
/backup-2024-01.zip reachable (HTTP 200) — full-site dump exposedLive attack probes5 modulesNot available
Active probes against a running site. Not available — reserved for a future penetration-testing product. No GateTest scan or tier runs these probes today.
liveSqlInjectionLive SQL-injection probe — error-based, boolean, and timing payloads against discovered endpoints.
Live SQL-injection probe — error-based, boolean, and timing payloads against discovered endpoints.
Timing payload on /api/search?q= delayed response 5.1s — injectableliveXssLive reflected-XSS probe — reflection detection on discovered endpoints.
Live reflected-XSS probe — reflection detection on discovered endpoints.
Payload reflected unencoded in /search results pagelivePathTraversalLive path-traversal probe — /etc/passwd and win.ini read detection.
Live path-traversal probe — /etc/passwd and win.ini read detection.
?file=../../etc/passwd returned root:x:0:0 — traversal confirmedliveAuthBypassLive auth-bypass probe — tests whether injected headers grant unauthenticated access.
Live auth-bypass probe — tests whether injected headers grant unauthenticated access.
X-Forwarded-For: 127.0.0.1 unlocked /admin without a sessionliveIdorLive IDOR probe — tests whether other users' object IDs are reachable without authorization.
Live IDOR probe — tests whether other users' object IDs are reachable without authorization.
/api/orders/1001 readable from user B's session — IDOR confirmedHow we keep it quiet
The loudest complaint about every scanner is noise. These are not settings you tune — they are how the engine works by default.
One defect is one finding
When three modules flag the same line — say a tainted eval() seen by the taint tracer, the security scanner and code quality — you read it once, owned by the module with the most detail. Folded duplicates are counted and disclosed, never silently dropped.
Ranked by risk, budgeted to five
The PR comment opens with the five findings that matter most — blocking first, then severity, then confidence, exploitable classes before hygiene, a concrete file:line before an aggregate. Everything else is collapsed under it. Nobody scrolls a wall.
Dependency alerts that can actually hurt you
A CVE blocks only when it sits in a production dependency your source actually imports. Dev-only tooling and installed-but-unused packages are reported with the reason — "pulled in only by devDependencies" — and never turn the check red.
Errors need confidence to block
Every error carries a confidence score from path and source context. Below the threshold it is shown, not enforced, and the report says how many were held back. Rules your team keeps dismissing are softened automatically by the flywheel.
Environment failures are not your defects
If a tool cannot run where the scan runs — no lockfile, no browser, no test runner installed — that is reported as a skip with the reason. It never becomes a red X on your code.
Fragments, fixtures and vendored code are not pages
SEO, accessibility and layout rules run on full documents, not template partials; test fixtures, docs screenshots and compiled vendor CSS are recognised for what they are. Measured on real repositories, with a positive control for every rule so quiet never means muted.
The fix flywheel
When the gate produces a finding that you've paid to have fixed, the pipeline is an AI fix engine working under hard gates. The engine checks the recipe store first — a promoted recipe replays for free. Otherwise the engine proposes a minimal, surgical diff (on the CI path, three competing hypotheses in a single call). Every candidate patch must parse, and the fixed file is re-scanned: the original finding must be gone and nothing new raised. A no-op patch is rejected, and per-tier budget caps mean a fix can never cost more than you paid for it.
Deterministic replay of fixes the AI layer has already proven. A recipe is distilled from a small, templatey AI diff and replays only after it has been confirmed enough times to be promoted to stable — an unproven patch never auto-applies.
Repeat shapes the AI layer has solved before, once their recipe has earned promotion. Zero cost, zero model call.
// match by ruleKey + file ext // hit: js-reject-unauthorized // recipe status: stable
// recipe applied, zero cost // AI never called
The AI fix engine proposes a minimal, surgical diff for the finding — deeper analysis on the paid fix tiers. On the CI path it generates three competing hypotheses in a single call and the best-ranked candidate wins. Capped per tier so spend never exceeds margin.
First-time-seen patterns. Bespoke business-logic bugs. Anything a template can't model.
// novel pattern: ad-hoc auth check // mixed with feature-flag rollout // no canonical shape
// AI reasons from your code // three hypotheses, best wins // smallest diff that fixes it
Every candidate patch must parse. A patch that breaks the file's syntax is discarded on the spot, a crash falls through to the next candidate, and a no-op diff is rejected outright.
Stops a bad patch before it can touch your branch — nothing that fails to parse ever reaches a PR.
// candidate patch B // parse → SyntaxError
// discarded, never applied // candidate A carries on
The fixed file is re-scanned by the same engine that raised the finding. The fix must make the original finding disappear without raising anything new — on the CI path your own test suite is run as the final judge.
Proves the fix is real. A patch that silences the symptom but fails the re-scan or the tests never ships.
// re-scan: finding gone? // new findings introduced? // tests still green?
// all three yes → patch lands // any no → rejected
Cost trend as recipes accumulate
When the AI layer solves something and the diff is small and templatey, theauto-distillstep can record a recipe in your local store. A recipe replays — with no AI call at all — once it has been confirmed enough times to be promoted to stable; an unproven patch never auto-applies. The chart below is the design goal: repeat shapes stop reaching the AI layer, so the paid share falls as promoted recipes accumulate.
Illustrative — actual ratio depends on codebase shape and recipe-hit rate. The architectural goal is that repeat patterns stop reaching the AI layer entirely.
The four tiers
Same engine, same modules, same queue. The tiers differ in what we layer on top of the base scan — and we're honest about what you don't get at each tier. “no” means no.
| What you get | Quick | Full | Scan + Fix | Forensic |
|---|---|---|---|---|
| Price | $29 | $99 | $199 | $399 |
| Modules run (every module that applies to a repo) | 4 | All | All | All + nuclear suite |
| Findings clustering by root cause | ✓ | ✓ | ✓ | ✓ |
| Health score / verdict | ✓ | ✓ | ✓ | ✓ |
| Detailed report (file, line, advisory) | ✓ | ✓ | ✓ | ✓ |
| AI code review (reads your code, not patterns) | no | ✓ | ✓ | ✓ |
| Auto-PR with working fixes | no | no | ✓ | ✓ |
| Iterative fix loop with retry | no | no | ✓ | ✓ |
| Cross-fix syntax + scanner gate | no | no | ✓ | ✓ |
| Regression test generated per fix | no | no | ✓ | ✓ |
| Pair-review (a second AI reviewer critiques) | no | no | ✓ | ✓ |
| Architecture annotations | no | no | ✓ | ✓ |
| Per-finding AI diagnosis | no | no | no | ✓ |
| Cross-finding attack-chain correlation | no | no | no | ✓ |
| Mutation testing (via GitHub Action) | no | no | no | Action |
| Chaos / fuzz pass (via GitHub Action) | no | no | no | Action |
| CTO-readable executive summary | no | no | no | ✓ |
Action = available via the GitHub Action with mutation: true / chaos: true. These two checks need a CI runner (your test suite for mutation, a headless browser for chaos) so they run wherever your CI runs, not on the website-only scan flow.
Per-scan payment at every tier. One-time charge via Stripe at checkout — one-time for scan tiers (no auto-renew; Continuous and MCP are monthly). If a scan fails to start or crashes mid-way, contact support — we re-run it or issue a credit at our discretion.
The fix workflow in your own CI
Beyond the managed scan, GateTest ships a GitHub Actions workflow that runs in your CI with your own API key. When CI breaks, the workflow pipes the failing log through the same fix engine — promoted recipes replay first, then the engine proposes three competing patches that must survive the syntax and test gates — applies the fix, and opens a follow-up PR. Same engine, same recipe store, your bill with the AI provider rather than ours.
name: GateTest fix workflow
on:
workflow_run:
workflows: ["CI"]
types: [completed]
jobs:
heal:
if: ${{ github.event.workflow_run.conclusion == 'failure' }}
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with: { node-version: '20' }
- run: npx -p @gatetest/cli gatetest --suite full --auto-pr
env:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}- 1CI fails
Workflow_run trigger fires on conclusion: failure.
- 2Logs in
Heal step downloads the failing job's logs and the diff.
- 3Fix engine
Recipe replay first, then the AI engine's three hypotheses race through syntax and test gates.
- 4Fix PR
Patch lands on a follow-up branch, PR opens against your default.
The stack
We deliberately keep the stack small. Every box below earns its place — no “just in case” services, no orchestration layers we don't need. The serverless rule is hard: no in-memory state between requests, ever.
Next.js 16 (App Router) + Tailwind 4. Server Components everywhere except where interactivity demands client.
Node on our own managed host. Every request handler is stateless — no in-memory persistence between requests.
Postgres on Neon. Holds scan_queue, audit log, fix-recipe store, customer sessions.
Stripe upfront-charge. Scan tiers are one-time payments at checkout — no auto-renew. Continuous ($49/mo) and MCP ($29/mo) are monthly subscriptions, cancel anytime.
AI-powered fix and review engine — deeper analysis on the paid fix tiers (Scan + Fix, Forensic), a lighter pass on the free and high-volume paths. Our key for managed scans; your key for the fix workflow in your own repo.
Dual-host: GitHub App webhook and Gluecron Signal Bus. HostBridge abstraction means new hosts plug in without rewiring.
A real headless Chromium, driven by the engine for the chaos, explorer, and runtime-error modules; Firefox and WebKit join for cross-browser diffs.
All scan state lives in Postgres or in Stripe's payment-intent metadata. We never write a Map or module-level variable that's expected to survive across requests — the function instance that picked up your second-page poll is not the one that ran your scan.
What GateTest doesn't do (yet)
Every QA vendor promises the moon. Here's what we don't deliver today. If any of these are blockers for you, the honest answer is “not yet.”
- 01
Doesn't replace a senior engineer's code review. We catch the bugs that have a recognisable shape; humans still own architecture and product judgement.
- 02
Doesn't catch logic bugs that need domain context. If your invariant is 'don't ever discount over 30%', no scanner can know that without you telling it.
- 03
Doesn't fix bugs that span 5+ files without human review. Multi-file refactors are flagged but require an engineer to drive.
- 04
Coverage on Rust, Go, and Java is shallower than JS/TS/Python today. We have language-specific modules for nine non-JS backends but the depth is honestly thinner than our JS coverage.
- 05
Hosted scans have a file cap. Full, Scan + Fix and Forensic read up to 4,000 source files per scan (prioritised by relevance); the free preview and the Quick tier sample 60. A very large monorepo gets a representative slice, not exhaustive coverage. The CLI and GitHub Action scan everything, with no file cap.
- 06
No on-prem deployment yet. Everything runs on our own managed host with a Postgres (Neon) queue today. Air-gapped customers are on the roadmap.
- 07
The editor extension is brand new (on the Visual Studio Marketplace and on Open VSX — the registry Cursor, Windsurf and VSCodium read — since 16 September 2026). It runs the same engine in-process and shows findings in the Problems panel, but it has no install base or reviews yet. The proven loop is still push → CI → PR comment.
Run it against your code
Architecture is just words until you see the report. The free URL scan takes well under a minute and returns a real health score against your live site.