Your codebase is hiding something.

A 21-second film. A light crosses a dark codebase and finds six bugs, the first of them a refund that pays out twice. The lights come on and show 52. Over the next weeks the bugs are caught and fixed, then stacked by the part of the code they came from. The film ends on the install command, npm install --save-dev @gfdelarue/testkit.

Prove every one.

A campaign gives your coding agent a target. Every bug it finds lands in your GitHub or Gitea as an issue, with a test that fails until you fix it.

A refund that pays out twice.Checkout · high · unnoticed for 107 days

src/checkout/__testkit__/refund.test.ts
import { endpoint } from "@gfdelarue/testkit/environment";import { expect, test } from "vitest";test("a refund pays out once", async () => {  const url = `${endpoint("api")}/orders/8841/refunds`;  const first = await fetch(url, { method: "POST" });  const second = await fetch(url, { method: "POST" });  expect(first.status).toBe(201);  expect(second.status).toBe(409);});

Expected 409. Received 201.

#1400 A refund pays out twice

Expected
409 on the second request
Observed
201, and a second payout
Root cause
A retry with no idempotency key, since 42c7079
Reproduce
Run refund.test.ts

See what brings them in.

Migrations are 5% of merges and 22% of bugs.

  • 41Dependency bumps14% of merges
  • 29Feature work46% of merges
  • 25Migrations5% of merges
  • 9Hotfixes8% of merges
  • 7Refactors18% of merges
  • 5Config changes9% of merges

Know where they come from.

Checkout is 16% of the code and 37% of the bugs.

  • 43Checkout16% of the code
  • 20Billing14% of the code
  • 12Catalog21% of the code
  • 11Data layer10% of the code
  • 9Admin15% of the code
  • 8Auth7% of the code
  • 7Search11% of the code
  • 6Notifications6% of the code

See what catches them.

Campaigns caught 58 of the 116.

  • 58By a campaign
  • 34Before merge
  • 24In CI

See how long they hid.

35 days unnoticed, at the median. After the first campaign, 6.

We keep the facts. You keep the rest.

Issue
github.com/acme/shop/issues/1400
Severity
high
Area
Checkout
Introduced
42c7079 · 14 Apr 2026
Caught
30 Jul 2026
Fixed
a47fc8a · 16 Aug 2026
  • The bug report
  • The failing test
  • The evidence

If Turnstone lost every byte tomorrow, you would lose your charts. Nothing else.

Now look at yours.

Get startedThe CLI is free. Turnstone has a free tier.