Real scans. Real findings. No demo data.

Hall of Scans

Every result on this page came from running GateTest against a real codebase. No fabricated numbers. No cherry-picked examples — including our own false positives, which we publish and then fix. Each card names the engine that ran it: the July 2026 scans used today's 120-module engine (88 modules apply to a repo without a live URL); the archive entries ran on the 39-module April engine.

🔒 Scans run in memory — code is never stored. Findings published with platform owner consent.

2,607
Errors found
10,101
Warnings surfaced
4
Repos scanned
120
Modules in the engine
GateTest — self-scan (this product's own repo)
Full suite · 120-module engine · self-scan·2026-07-12·76/88 modules passed
137
Errors
1,963
Warnings

“Same-day proof: the morning quick-suite gate found 85 blocking issues in our own repo — a crashed ESLint config, a real fs TOCTOU race, 45 undocumented error swallows. All fixed at root cause by evening; the gate now passes 41/41. Every fix is in the public git history.”

Top Findings

ERROR
authBypass—84 of the 137 errors are this module reading route-shaped pattern strings inside our own scanner source — a false-positive class we're fixing next. Publishing it anyway: the correlator doesn't get to hide our own noise.
ERROR
security—Math.random() used where a security-sensitive value belongs — crypto.randomBytes is the fix
ERROR
seo—Corpus/demo HTML files missing meta descriptions and Open Graph tags
WARN
errorSwallow—Catch blocks that log without re-throwing — visible in logs, invisible to callers
Vapron — production scheduling platform (dogfood)
Full suite · 120-module engine · dogfood·2026-07-12·56/88 modules passed
1,697
Errors
7,128
Warnings

“1,697 errors on a pre-launch production platform under the current 120-module engine. Exact file/line detail is withheld here until the fixes land — these are live systems — but the counts are unedited. This is the queue GateTest's own CI gate is now grinding down on every push.”

Top Findings

CRITICAL
security—innerHTML assignments from non-constant sources — XSS surface
ERROR
errorSwallow—113 silent error swallows — empty catches, .catch(() => {}), log-without-rethrow across API and auth paths
ERROR
envVars—143 env vars read in code but absent from .env.example — the config contract doesn't know they exist
ERROR
accessibility—278 findings — unlabeled inputs, animations without prefers-reduced-motion
ERROR
bashSafety—382 shell-safety findings across ops scripts
Gluecron.com — git hosting platform (dogfood)
Forensic suite · April 2026 engine (39 modules) · dogfood·2026-04-26·26/39 modules passed
649
Errors
743
Warnings

“The cleverest chain of this batch: hardcoded secret + missing from .env.example. Neither finding alone is alarming. Together they mean you cannot rotate the secret even if you wanted to — the rotation attempt itself would break production.”

Top Findings

CRITICAL
secrets—Hardcoded API key in workflow file AND missing from .env.example — rotation is structurally impossible
ERROR
asyncIteration—forEach(async ...) in webhook handler — errors swallowed, events processed out of order
ERROR
moneyFloat—parseFloat() on billing amounts — sub-cent drift accumulates across high-volume cron runs
ERROR
raceCondition—findOne → insert pattern on job table with no transaction or ON CONFLICT guard — duplicate-job race

Cross-Finding Attack Chains

CRITICAL
Secret rotation is structurally impossible
Hardcoded WORKFLOW_SECRETS_KEY in CI + missing from .env.example → the env contract doesn't even know the key exists → any rotation attempt breaks CI silently
HIGH
Billing drift + duplicate job race
parseFloat on cron billing amounts + duplicate-job race on insert → a race creates two billing events, both use float arithmetic → double-charge with rounding error
public legal-tech platform
Forensic suite · April 2026 engine (39 modules) · consented scan·2026-04-26·31/39 modules passed
124
Errors
267
Warnings

“The correlator returned 0 chains on this repo — findings were genuinely independent. We didn't pad. But the money-float finding in a legal-tech trust-account handler is, in isolation, a textbook fintech bug that regulators call fraud when it accumulates at scale.”

Top Findings

CRITICAL
moneyFloat—parseFloat() on trust-account transaction amounts in TrustActions.tsx — a legal-tech product handling client trust money
ERROR
errorSwallow—Multiple .catch(() => {}) on payment promise chains — failed payments silently succeed from the caller's perspective
ERROR
logPii—console.log(req.body) in auth endpoint — logs contain SSN and bank routing numbers from form submissions
WARN
raceCondition—findOne → update race on trust-account balance with no transaction guard

Cross-finding correlation: 0 chains identified. Findings were genuinely independent — the correlator does not pad results.

See what's in your repo

Free preview scan — no card required. Quick suite: syntax, lint, secrets, code quality. Runs in under 30 seconds on any public repo.

Free preview scan →See full pricing