What it is
Most test suites check that an app works when it's used correctly. AURA checks what happens when it isn't. It drives a cloud browser through the things real users do by accident — double-clicking submit, navigating away mid-request, losing the connection halfway through, pasting something hostile into a form — and watches for the damage: duplicate orders, overlapping writes, 500s, negative totals, spinners that never resolve, controls buried under an overlay.
When it finds a bug it doesn't just report it. It shrinks the sequence down to the shortest one that still breaks the app, re-runs that in clean sessions to prove it isn't a fluke, and writes a Playwright test that fails until the bug is fixed. It ships as a hosted app: add a site, verify you own it, queue a scan, read the report.
How it works
An attack library, not a script
Rapid clicks dispatched inside the page, so five clicks in 100 ms stay 100 ms. Interrupted navigations, emulated latency and offline, stale interactions, and input designed to break naive handling.
Deterministic oracles decide
Four oracles — hard failures, behavioral, visual, and sandboxed invariant rules — decide what actually went wrong. The language model only plans where to attack next; it never gets to call something a bug.
Shrunk, then proven
Delta debugging cuts an eight-step failure down to the two or three steps that matter, each candidate replayed in a fresh session, and the survivor reproduced several times over before it is reported at all.
A test you can keep
Every confirmed bug leaves an evidence package — screenshots, network and console log, the minimized sequence — and a generated Playwright spec that drops straight into the project's own suite.
Hosted, and locked down
Accounts with two-factor and passkeys, an encrypted vault for the login it uses on your site, domain-ownership verification and SSRF blocking before any scan runs, an append-only hash-chained audit log, and Stripe for billing so no card details ever reach it.
Where it stands
The pipeline runs end to end. On a purpose-built benchmark app with ten deliberately seeded bugs, AURA finds all ten — each minimized to five steps or fewer and reproduced three times in clean sessions. The hosted app, the billing and a full security-hardening pass are built and verified against a live stack. A line-by-line audit of the whole codebase is written, and its findings are being worked through before anyone else's site gets scanned.
Built with
TypeScript · Playwright · Node.js · PostgreSQL · Claude · Stripe
· QA automation / web application — built by Musa Alanssari, a software engineer in Houston, Texas. Aug 2026 — Present.