15 probes · 4 layers · self-improving

Test any codebase.
Layer upon layer.

alltest runs every kind of probe — static, dynamic, fuzz, meta — against any repository to surface bugs, vulnerabilities, and hardcoded secrets.

Then it writes the actual fix — a patch, not a hint — learns issue patterns it has never seen, and tests itself all the way down.

$ npx @anthonysnider/alltest scan .
alltest scan ./repository
critical high medium low clean
15
probes · 4 layers
100
tests · 10 self-layers
40+
secret patterns
0
config required
the engine

Four layers of probing, in order.

Every check is a pluggable probe. They run from cheapest to deepest, so a scan is fast by default and thorough on demand.

LAYER 01

Static

Read the source without running it — secrets, injection, unsafe patterns, contract flaws, dependency & config risk. Works even on code that won't parse.

LAYER 02

Dynamic

With --exec: build the project and run its test suite. A red build or a missing suite is the most objective failure there is.

LAYER 03

Fuzz

Property checks over the data a project ships — malformed JSON and config that would crash it at load, before your users find it.

LAYER 04

Meta

alltest inspects its own registry and finding schema while it runs. The tester verifies itself on every scan.

coverage

Fifteen probes. Every kind of flaw.

From leaked private keys to reentrant contracts to unknown-format secrets caught by entropy alone.

secretsstatic

Private keys (incl. EVM Wallet), 40+ vendor tokens, DB & credential URLs, committed key files.

entropy-secrets0-day

High-entropy tokens of unknown vendor/format — the leaks no signature list anticipated.

dangerous-jsstatic

eval & indirect eval, command & SQL injection, DOM-XSS, disabled TLS, JWT none, weak randomness.

python-dangerstatic

pickle/torch/yaml deserialization (RCE), shell=True, verify=False, SSTI, hardcoded secrets.

soliditystatic

tx.origin auth, unchecked calls, delegatecall, selfdestruct, block-var randomness, unbounded loops.

depsstatic

Unbounded versions, missing lockfile, curl|bash in scripts, install hooks, optional/peer deps.

env-leakstatic

Error/stack traces in responses (Express/Koa/Fastify), process.env dumps, wildcard CORS.

config-hygienestatic

Committed .env, private-key files vs public certs, .env not gitignored, missing .gitignore.

ci-dockerstatic

:latest images, ADD-from-URL, root containers, unpinned Actions, pull_request_target.

complexityanomaly

High cyclomatic complexity, long functions, deep nesting — the hot-spots where latent bugs hide.

debtstatic

TODO/FIXME/HACK, not-implemented stubs, stray logs, loose types — the highest-signal ML labels.

json-roundtripfuzz

Parses every committed JSON/config and verifies it round-trips. Malformed data crashes apps.

builddynamic

Runs the project build (npm/tsc/cargo/go). A failing build can't ship, full stop.

testsdynamic

Runs the test suite and flags projects with no tests at all — no automated safety net.

self-integritymeta

Asserts alltest's own probe registry and finding schema hold — on every single run.

turtles all the way down

A tester you can trust — because it tests itself.

A green test suite is worthless if the assertions don't depend on the code being right. So alltest tests the tests, then tests that.

  1. Unit — tests FOR the testerEvery probe verified against ground-truth fixtures with known planted flaws.
  2. Meta — the suite tests itselfalltest scans its own source; a probe checks the registry & schema.
  3. Meta-meta — proof it can go redA test that proves the self-test would actually fail on a real regression.
  4. Mutation — the tests have teethDetection logic is deliberately broken; surviving mutants expose coverage holes.
  5. Regressions — every review finding, lockedEach confirmed false-positive and false-negative is a permanent test.
it gets smarter

Every scan feeds the next one.

Novel findings are learned into a knowledge base; recurring ones become new detection rules. Every finding is also a labeled example for a future issue-detection model.

scan

Detect

15 probes surface findings across any language, each with a stable signature.

learn

Recognize

Never-seen signatures are recorded; the tool knows tomorrow what was 0-day today.

promote

Rule-synthesize

Signatures seen often enough graduate to candidate detection rules.

corpus

Train

Every finding becomes a labeled JSONL row — the seed set for a detection model.

real output

Findings written to be fixed.

Exact location, redacted snippet, why it matters, a concrete remediation. Human-readable, or JSON / SARIF / JSONL for agents and CI.

alltest scan ./server --format table
  alltest — ./server
  418 files · 6 languages · 15 probes · 210ms

  server/db/users.js
    ✗ HIGH     SQL built via string concatenation:88
        ↳ Use parameterized queries instead of building the query string.
  .env
    ✗ HIGH     Environment file committed:1
        ↳ git rm --cached, add to .gitignore, and rotate anything it held.
  config.js
    ✗ HIGH     High-entropy secret · ADMIN_KEY:5
        ↳ Matches no known pattern but looks like a token — verify & rotate.
  contracts/Vault.sol
    ⛔ CRITICAL Authorization via tx.origin:42
        ↳ tx.origin is phishable. Use msg.sender for auth checks.

  Summary: 1 critical · 3 high
  risk score 14.2 · files an AI-fixable issue per finding
not just advice

The actual fix. Ready to apply.

Every fixable finding carries the concrete before→after change — a patch, not a hint. Mechanical fixes apply themselves; risk-bearing ones come as a reviewed suggestion.

alltest fix ./server --apply
   auto   disable-tls-verify server/http.js:44
     Remove rejectUnauthorized:false so TLS certificates are validated again.
     - const agent = new https.Agent({ rejectUnauthorized: false });
     + const agent = new https.Agent({});

   auto   py-yaml-load loader.py:12
     - data = yaml.load(f, Loader=yaml.Loader)
     + data = yaml.safe_load(f)

   review hardcoded-password config.js:5
     Set DB_PASSWORD in the environment, then rotate the exposed value.
     - const dbPassword = "sup3r…";
     + const dbPassword = process.env.DB_PASSWORD;

  Applied 2 auto-fixes. 1 finding needs a reviewed change.
one command, any repo

Point it at your code.

No config. No account. Just findings — and a tester that tests itself.

$npx @anthonysnider/alltest scan .