Writing code got cheap. Answering for it did not. Breken takes the answering half: it reads a codebase nobody on the team wrote, proves the bug in a sandbox, and opens the pull request that fixes it with the proof attached. It is Brekfuz's second product, and I built every layer of it: the code intelligence that maps the repository, the sandbox that proves the bug, and the renderer that shows the evidence.

Merged by the maintainers ofTwelve of the 34 repositories that merged Breken's fixes: 54 fixes in all, into projects with 783k+ combined stars.

The system I built

One map of the codebase, worked four ways: pull-request review, dead-code cleanup, bug scans, and support ticket to root cause to fix. Every path ends in a pull request or an answer. 277,000+ lines of TypeScript, held by 9,523 tests with none skipped.

Fig. 01From bug to merged fixEvery fix Breken opens has already failed and then passed in its sandbox.

  1. Map the codebase

    SCIP indexers build a commit-addressed call graph across six languages. Every edge is labelled exact, inferred or advisory.

  2. Prove the bug

    A regression test must fail at the exact production commit, inside a sandbox where every binary is pinned by hash.

  3. Write the fix

    The test goes red to green, then clears three gates: a second model's review, the repository's own checks, and a re-analysis.

  4. Render the evidence

    The renderer photographs the affected routes and serves the screenshots through signed links GitHub can display.

  5. Open the pull request

    Root cause, failing test, fix and proof arrive in one pull request, ready for a maintainer to merge.

What it is made of

  • Code intelligence. SCIP indexers map the call graph across TypeScript, Go, Python, Java, Ruby and Rust, with tree-sitter for excerpts. Every edge is labelled exact, inferred or advisory, and "nothing calls this" is said only when the search was exhaustive. UNKNOWN is a valid answer.
  • A six-stage investigation. Prepare, gather evidence, diagnose, reproduce, fix, verify. Diagnosis runs three blind lenses and an adversarial judge, then opens every citation it leans on.
  • The sandbox. E2B runners, with Daytona as a second provider, boot from a template where every binary, CLI and detector is pinned by SHA-256. A broker caps requests, tokens and dollars on every run.
  • Gates, not vibes. A model from a different lab reviews the fix, the sandbox runs the repository's own typecheck, tests and build, and a re-analysis confirms the finding is gone. Two of three is a refusal. A UX gate stops a try/catch from passing as a fix on user-facing code.
  • The renderer. Investigations photograph the affected routes and serve the shots through signed snapshot links, so GitHub renders the evidence even from a private repository. Every review carries a machine-readable verdict.
  • Review on a budget. Three findings at most, each backed by a proof object, in one comment edited in place. The deterministic half of a large review runs in 4.2 seconds, across ten languages.
  • Signals in, fixes out. Sentry, PostHog, Zendesk, Slack, Linear and Vercel logs turn complaints into cases. A GitHub App installs in one click, coding agents query it over MCP, and Stripe runs billing.

Key decisions

Prove it before saying it. A finding that cannot be reproduced does not get a pull request. The regression test has to fail at the production commit and pass with the fix, inside a sandbox pinned down to the hash of every tool. That is slower than generating a patch from the issue text, and it is why a maintainer can merge the result without re-deriving it.

Ship the reproduction as a repository, not a paragraph. A maintainer who asks for a reproducer wants something to run. Breken ships a standalone repository with pinned dependencies and a script that drives a browser and prints a verdict.

Say less, prove more. A reviewer that posts twenty comments trains a team to ignore it. Breken posts at most three findings, each backed by a proof object the database will not store a finding without, in one comment it edits in place.

The outcome

Breken is live at breken.ai, and maintainers keep merging its fixes: 54 across 34 repositories with 783,000+ combined stars.