# I Built a Bot That Reproduces GitHub Bugs Automatically — Here's What Broke (and What I Learned)

> Source: <https://dev.to/qxmcu/i-built-a-bot-that-reproduces-github-bugs-automatically-heres-what-broke-and-what-i-learned-3b12>
> Published: 2026-08-28 10:35:36+00:00

As a maintainer, even a solo one on a small project, the most time-consuming part of fixing a bug usually isn't writing the fix. It's *reproducing* it. Someone files an issue, the description is vague, and you spend twenty minutes just trying to get your machine into the same broken state theirs is in before you can even start debugging.

I wanted that step gone.

**Ghost Hunter** is an open-source CLI + webhook bot that automates bug reproduction on GitHub. Comment `bot/reproduce`

on any issue, and it:

No more "can you share more details?" back and forth. No more manually setting up an environment just to confirm a bug is real.

```
ghost init      # set up auth + LLM keys
ghost serve     # start the webhook listener
```

Comment `bot/reproduce`

on an issue, and Ghost Hunter takes it from there.

This is my first real solo open-source project, and I underestimated how valuable *critical* feedback would be the moment it went public.

Within the first day, two commenters independently flagged real security concerns I hadn't fully thought through:

My first instinct was mild panic. My second was: this is exactly the kind of feedback that makes a project better before it gets a chance to actually hurt someone. I dug in, understood the actual attack surface in my sandbox code, and shipped fixes rather than brushing the comments aside.

Turns out I wasn't the only one who's had to think about this — [Metabase's own internal bug-reproduction tool](https://www.metabase.com/blog/reprobot-github-issue-triage-agent) deliberately requires a human-in-the-loop trigger specifically to prevent this exact class of attack on public repos. That was a useful gut-check: a team with real security resources treated this as a hard requirement, not an afterthought.

I'd rather be upfront about this than pretend the README says everything's perfect:

Both are called out explicitly in the repo's README rather than hidden.

It's fully open-source (MIT licensed): [github.com/qxmcu/ghost-hunter](https://github.com/qxmcu/ghost-hunter)

I'd genuinely welcome more of the kind of feedback I got this week — bug reports, security concerns, "this is a bad idea because X," all of it. That back-and-forth is the best part of building in the open. Plus I have been working on my README a LOT. Be sure to check it out :)