Show HN: No more code reviews. Fuzz instead
I'm an ex-CTO and many companies I look in today, want to get AI coded apps into production, but engineering code reviews are the new bottleneck - and engineers don't even love to do them.
No more code reviews. Fuzz instead.
appfuzz works with WASM and runs the .wasm thousands of times against a simulated backend and reports problems: crashes, n+1 queries, XSS, SQL injection, leaked secrets, blown IO/CPU/instruction budgets.
Try it of your own - you don't need an app for the demo:
Why: agents write code faster than anyone can review it, and in many companies people outside engineering (marketing, sales, support) want to ship apps too - pressure from the CEO is high.
But then engineers get the pager alerts.
One way to make them safer is to treat them like iPhone/iOS apps: sandbox, permissions, app review (what appfuzz does).
It works with Wasm components in any language, Spin, wasmCloud, Fastly Compute, and Shopify Functions.
MIT. Very early state.
Which platform should I add, and what should it look for?
1 comment
[ 5.8 ms ] story [ 19.0 ms ] threadGreat concept and very real application. Adding Cloudflare Workers with D1 & R2 binding would be a nice addition to your list. As you said AI generated apps are being produced ten to the dozen at the moment with a number of them being deployed to CF workers, aided by how easy CLI/binding setup is.
What should it look for though? (items/challenges I've personally had to deal with, so yes, I'm being self-centered on the needs for this one)
- Race conditions on read-then-write SQLite/D1 queries. I've found with some Agents that they write non-atomic SELECT then UPDATE logic instead of atomic single-statement updates, causing breaks under concurrent requests.
- Unbounded subrequests or missing idempotency checks on third-party webhooks. Example being Stripe retries triggering duplicate writes.
- Blowing the 10ms/50ms Worker CPU time limit on unindexed queries or heavy JSON parsing.
Quick question on how your simulated backend works. Does it automatically fake the database tables on its own by reading the code or do you have to provide either the real or a sample schema first?