{"slug": "i-built-a-bot-that-reproduces-github-bugs-automatically-here-s-what-broke-and-i", "title": "I Built a Bot That Reproduces GitHub Bugs Automatically — Here's What Broke (and What I Learned)", "summary": "A developer released Ghost Hunter, an open-source CLI and webhook bot that automatically reproduces GitHub bugs when users comment 'bot/reproduce' on an issue. The project received critical security feedback within its first day, prompting fixes and explicit documentation of limitations. The developer also cited Metabase's internal tool as validation for requiring human-in-the-loop triggers to prevent attacks on public repos.", "body_md": "As a maintainer, even a solo one on a small project, the most time-consuming part of fixing a bug usually isn't writing the fix. It's *reproducing* it. Someone files an issue, the description is vague, and you spend twenty minutes just trying to get your machine into the same broken state theirs is in before you can even start debugging.\n\nI wanted that step gone.\n\n**Ghost Hunter** is an open-source CLI + webhook bot that automates bug reproduction on GitHub. Comment `bot/reproduce`\n\non any issue, and it:\n\nNo more \"can you share more details?\" back and forth. No more manually setting up an environment just to confirm a bug is real.\n\n```\nghost init      # set up auth + LLM keys\nghost serve     # start the webhook listener\n```\n\nComment `bot/reproduce`\n\non an issue, and Ghost Hunter takes it from there.\n\nThis is my first real solo open-source project, and I underestimated how valuable *critical* feedback would be the moment it went public.\n\nWithin the first day, two commenters independently flagged real security concerns I hadn't fully thought through:\n\nMy first instinct was mild panic. My second was: this is exactly the kind of feedback that makes a project better before it gets a chance to actually hurt someone. I dug in, understood the actual attack surface in my sandbox code, and shipped fixes rather than brushing the comments aside.\n\nTurns out I wasn't the only one who's had to think about this — [Metabase's own internal bug-reproduction tool](https://www.metabase.com/blog/reprobot-github-issue-triage-agent) deliberately requires a human-in-the-loop trigger specifically to prevent this exact class of attack on public repos. That was a useful gut-check: a team with real security resources treated this as a hard requirement, not an afterthought.\n\nI'd rather be upfront about this than pretend the README says everything's perfect:\n\nBoth are called out explicitly in the repo's README rather than hidden.\n\nIt's fully open-source (MIT licensed): [github.com/qxmcu/ghost-hunter](https://github.com/qxmcu/ghost-hunter)\n\nI'd genuinely welcome more of the kind of feedback I got this week — bug reports, security concerns, \"this is a bad idea because X,\" all of it. That back-and-forth is the best part of building in the open. Plus I have been working on my README a LOT. Be sure to check it out :)", "url": "https://wpnews.pro/news/i-built-a-bot-that-reproduces-github-bugs-automatically-here-s-what-broke-and-i", "canonical_source": "https://dev.to/qxmcu/i-built-a-bot-that-reproduces-github-bugs-automatically-heres-what-broke-and-what-i-learned-3b12", "published_at": "2026-08-28 10:35:36+00:00", "updated_at": "2026-08-28 10:49:34.382506+00:00", "lang": "en", "topics": ["developer-tools", "ai-agents", "ai-tools", "ai-safety"], "entities": ["Ghost Hunter", "GitHub", "Metabase", "qxmcu"], "alternates": {"html": "https://wpnews.pro/news/i-built-a-bot-that-reproduces-github-bugs-automatically-here-s-what-broke-and-i", "markdown": "https://wpnews.pro/news/i-built-a-bot-that-reproduces-github-bugs-automatically-here-s-what-broke-and-i.md", "text": "https://wpnews.pro/news/i-built-a-bot-that-reproduces-github-bugs-automatically-here-s-what-broke-and-i.txt", "jsonld": "https://wpnews.pro/news/i-built-a-bot-that-reproduces-github-bugs-automatically-here-s-what-broke-and-i.jsonld"}}