alltest runs every kind of probe — static, dynamic, fuzz, meta — against any repository to surface bugs, vulnerabilities, and hardcoded secrets.
Then it writes the actual fix — a patch, not a hint — learns issue patterns it has never seen, and tests itself all the way down.
npx @anthonysnider/alltest scan .
Every check is a pluggable probe. They run from cheapest to deepest, so a scan is fast by default and thorough on demand.
Read the source without running it — secrets, injection, unsafe patterns, contract flaws, dependency & config risk. Works even on code that won't parse.
With --exec: build the project and run its test suite. A red build or a missing suite is the most objective failure there is.
Property checks over the data a project ships — malformed JSON and config that would crash it at load, before your users find it.
alltest inspects its own registry and finding schema while it runs. The tester verifies itself on every scan.
From leaked private keys to reentrant contracts to unknown-format secrets caught by entropy alone.
Private keys (incl. EVM Wallet), 40+ vendor tokens, DB & credential URLs, committed key files.
High-entropy tokens of unknown vendor/format — the leaks no signature list anticipated.
eval & indirect eval, command & SQL injection, DOM-XSS, disabled TLS, JWT none, weak randomness.
pickle/torch/yaml deserialization (RCE), shell=True, verify=False, SSTI, hardcoded secrets.
tx.origin auth, unchecked calls, delegatecall, selfdestruct, block-var randomness, unbounded loops.
Unbounded versions, missing lockfile, curl|bash in scripts, install hooks, optional/peer deps.
Error/stack traces in responses (Express/Koa/Fastify), process.env dumps, wildcard CORS.
Committed .env, private-key files vs public certs, .env not gitignored, missing .gitignore.
:latest images, ADD-from-URL, root containers, unpinned Actions, pull_request_target.
High cyclomatic complexity, long functions, deep nesting — the hot-spots where latent bugs hide.
TODO/FIXME/HACK, not-implemented stubs, stray logs, loose types — the highest-signal ML labels.
Parses every committed JSON/config and verifies it round-trips. Malformed data crashes apps.
Runs the project build (npm/tsc/cargo/go). A failing build can't ship, full stop.
Runs the test suite and flags projects with no tests at all — no automated safety net.
Asserts alltest's own probe registry and finding schema hold — on every single run.
A green test suite is worthless if the assertions don't depend on the code being right. So alltest tests the tests, then tests that.
Novel findings are learned into a knowledge base; recurring ones become new detection rules. Every finding is also a labeled example for a future issue-detection model.
15 probes surface findings across any language, each with a stable signature.
Never-seen signatures are recorded; the tool knows tomorrow what was 0-day today.
Signatures seen often enough graduate to candidate detection rules.
Every finding becomes a labeled JSONL row — the seed set for a detection model.
Exact location, redacted snippet, why it matters, a concrete remediation. Human-readable, or JSON / SARIF / JSONL for agents and CI.
alltest — ./server 418 files · 6 languages · 15 probes · 210ms server/db/users.js ✗ HIGH SQL built via string concatenation:88 ↳ Use parameterized queries instead of building the query string. .env ✗ HIGH Environment file committed:1 ↳ git rm --cached, add to .gitignore, and rotate anything it held. config.js ✗ HIGH High-entropy secret · ADMIN_KEY:5 ↳ Matches no known pattern but looks like a token — verify & rotate. contracts/Vault.sol ⛔ CRITICAL Authorization via tx.origin:42 ↳ tx.origin is phishable. Use msg.sender for auth checks. Summary: 1 critical · 3 high risk score 14.2 · files an AI-fixable issue per finding
Every fixable finding carries the concrete before→after change — a patch, not a hint. Mechanical fixes apply themselves; risk-bearing ones come as a reviewed suggestion.
● auto disable-tls-verify server/http.js:44 Remove rejectUnauthorized:false so TLS certificates are validated again. - const agent = new https.Agent({ rejectUnauthorized: false }); + const agent = new https.Agent({}); ● auto py-yaml-load loader.py:12 - data = yaml.load(f, Loader=yaml.Loader) + data = yaml.safe_load(f) ○ review hardcoded-password config.js:5 Set DB_PASSWORD in the environment, then rotate the exposed value. - const dbPassword = "sup3r…"; + const dbPassword = process.env.DB_PASSWORD; Applied 2 auto-fixes. 1 finding needs a reviewed change.
No config. No account. Just findings — and a tester that tests itself.
npx @anthonysnider/alltest scan .