Straight answers
Frequently asked questions
If a question is missing here, the docs go deeper - this page is the short version.
What does crashtest actually do?
It fires seeded attacks (identity spoofing, prototype pollution, burst floods, credential stuffing, cost-amplification probes - 13 across 5 modules) at your real route handlers inside your own Node process. Each attack returns one verdict: REFUSED (your defense held), EXPLOITED (you got hit), or BOUNDED (a known risk with an owner and a bound). Everything lands in a machine ledger your CI diffs against.
Is it safe to run on my real codebase?
Yes - that is the point. There is no socket, no network traffic, no live server. The harness hands your handlers in-process WHATWG Request objects backed by a fake D1/KV/env backend. Nothing leaves your machine, and nothing in the ledger can be a false positive from a flaky network, because there is no network.
How does it avoid ban waves and Cloudflare rate limits?
It cannot get banned: every request is an in-process function call, never a socket. Probe the same handler 8000 times and no firewall ever sees a packet. This is also why runs are deterministic and fast (the PRD metric is <60s on a small API).
How is this different from a pentest or a SAST scanner?
SAST tools (semgrep, CodeQL) read your code but never run it, so behavioral holes survive review. Pentest tools (ffuf, nuclei, ZAP) need a live server and network traffic - the wrong shape for a solo dev or an agent loop, and hosts throttle them. Crashtest is behavioral QA before deploy: it runs the code, in-process, with cost accounting and a regression ledger.
What is the ledger and why does CI care about it?
labs/crashledger.json records every attack id and its verdict. CI fails ONLY on a NEW EXPLOITED finding or a REFUSED-to-EXPLOITED regression - things that were fine yesterday that broke today. Accepted risks (with an owner and a bound on file) never re-alarm. That is the whole exit contract.
What is an accepted risk (BOUNDED)?
A risk you decided is worth taking, recorded with a named owner and an explicit bound ("rate-limiting deferred to the paid tier", bound = the limit value). A BOUNDED without owner + bound is demoted to EXPLOITED - an accepted risk without accountability is a finding, not a shrug.
Can I write my own attacks?
Yes - that is the pack system. An attack is an ESM module matching a small contract: { name, description, attacks: [{ name, run(harness, ctx) }] }. Drop it in packs/public/ (tracked, sharable) or packs/local/ (gitignored, private). The seeded context is deterministic so your pack is reproducible like everything else.
Does it work with my framework?
Shipped adapters: Cloudflare Pages Functions shape (plain handlers), Hono (app.request()), Express (app.handle()), Fastify (app.inject()), raw http.createServer handlers, and a WordPress subprocess spike (NDJSON over stdio - still no sockets). Multiple routes on one dispatching app? Use routeAliases. Playbooks per framework are in the docs.
What backends does the fake env support?
D1-style SQL (a real SQL-subset engine in-process - tables, uniques, seeds, D1-shaped error messages other attacks chain on), KV namespaces, secrets, and vars. You seed it with the shape of your real schema so the attacks exercise the real branching, and plant FAKE secrets to verify nothing ever echoes them.
What do exit codes mean in CI?
0: baseline held. 1: a NEW EXPLOITED finding, or a previously-REFUSED surface that regressed. 2: configuration problem (missing or malformed config/baseline) - the run is untrustworthy, which is different from "your app is weak". Never a false positive on undeclared routes: those degrade to skipped-REFUSED.
Who builds with this?
Agent developers who want a hardening pass as part of "done" (the primary audience - it is built to run in the agent loop), solo and small-OSS maintainers who cannot afford a pentest, and security-minded teams as a first-pass filter before human review.
How much does it cost?
Nothing. MIT-licensed, zero runtime dependencies, no account, no telemetry, no network. The npm package ships with signed provenance you can verify.