Languages
JavaScript, TypeScript and Python
Jest, Vitest and pytest are auto-detected, including common monorepo layouts.
abloh plants real bugs in a disposable copy of your pull request and runs your own tests. Every bug they miss comes back as a finding - with a proven test that catches it, ready to merge.
abloh runs as one check inside your existing CI - on the diff and nothing else, never touching your branch.
if (balance >= amount) {
if (balance > amount) {
if (reserved >= amount) {
const r = tx.commit();
catch { return null; }
charge(amount, user);
TIMEOUT_MS = 3000;
refund(order.total);
for (i = 0; i <= n; i++) {
queue.flush();
retries = 2;
transfer(to, from, amt);
if (!ok) return;
return user.email;
items.slice(0, n - 1);
db.rollback();
MAX_FEE = 0.05;
compare(b, a);
if (total > cap) {
catch { /* ignored */ }
while (n >= 0) {
if (reserved >= amount) {
if (balance > amount) {
47 killed · 1 survived
Your suite is green on this line.abloh writes the mistakes a model actually makes.47 die. This one your suite never sees.abloh proposes the test, and proves it.
A pull request checks only the lines you changed. The rest of your repository never faces that scrutiny. On the schedule you set, abloh audits all of it - and reports what escaped.
The audit starts on its own and runs for as long as it needs, on abloh's machines rather than your CI minutes.
Every file gets the same treatment a pull request gets: real bugs planted, your tests run against each one.
Only the gaps abloh proved are real, each with a test that closes it and has already been run against your suite.
Nothing to schedule and nothing to watch. See what the report holds
Jest, Vitest and pytest are auto-detected, including common monorepo layouts.
npx abloh init writes the workflow, the GitHub App covers the repos you pick. SHA-pinned action, OIDC auth, no long-lived tokens.
abloh plugs into the tools your team already works in — check runs on GitHub PRs, findings linked to Jira tickets, alerts sent to Slack.