{
  "id": 3943216,
  "title": "I Built a Bot That Reproduces GitHub Bugs Automatically — Here's What Broke (and What I Learned)",
  "url": "https://urgent.news/2026/08/28/i-built-a-bot-that-reproduces-github-bugs-automatically-heres-what",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-28T10:35:36.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/qxmcu/i-built-a-bot-that-reproduces-github-bugs-automatically-heres-what-broke-and-what-i-learned-3b12"
  },
  "original_language": "en",
  "account": "Title: Building a Bot to Reproduce GitHub Bugs Automatically\n\nThe problem: As a maintainer of a small project, the most time-consuming part of fixing a bug is not writing the fix, but reproducing it. Often, the issue description is vague, and users spend considerable time trying to recreate the broken state before debugging. The author wanted to eliminate this step.\n\nGhost Hunter: The solution is an open-source CLI + webhook bot that automates bug reproduction on GitHub. Users simply comment \"bot/reproduce\" on any issue, and the bot:\n\n1. Parses the issue text with an LLM to extract environment details and repro steps\n2. Spins up an isolated Docker container matching that environment\n3. Runs the reproduction steps inside the sandbox\n4. Posts the crash logs back to the issue automatically\n\nThe result is no more back and forth asking for more details or manually setting up an environment to confirm a bug is real.\n\nCommunity feedback: As a first-time solo open-source project, the author underestimated the value of community feedback. Within the first day, two commenters independently flagged security concerns.\n\n1. Prompt injection risk: A maliciously crafted issue could manipulate the commands executed inside the container\n2. Network isolation: By default, Docker does not restrict network access, allowing a poisoned issue to reach out to arbitrary hosts or scan a local network\n\nThe author dug into the issue, understood the actual attack surface, and shipped fixes instead of ignoring the comments. Metabase's internal bug-reproduction tool also requires a human-in-the-loop trigger to prevent this kind of attack.\n\nWhat's still a work in progress:\n1. GitHub App authentication is documented but not yet battle-tested end-to-end\n2. Free-tier LLMs on OpenRouter vary in reliability for the structured JSON output this tool depends on\n\nThe bot is fully open-source (MIT licensed): github.com/qxmcu/ghost-hunter. The author welcomes more feedback, including bug reports, security concerns, and suggestions.",
  "summary": "The problem As a maintainer, even a solo one on a small project, the most time-consuming part of fixing a bug usually isn't writing the fix. It's reproducing it. Someone files an issue, the description is vague, and you spend twenty minutes just trying to get your machine into the same broken state theirs is in before you can even start debugging. I wanted that step gone. What I built Ghost…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}