Paste a URL.
Break your app.
AI personas attack your web app simultaneously. Bug reports with screenshots, CI gating, and novelty tracking.
Free during beta · No account required
Paste your URL
Drop in any web app URL. Or add a breakit.config.json to your project and run it from CI.
AI personas attack
A confused grandma, a form abuser, a mobile user, an impatient teen, and a first-timer — all exploring at once with real browsers.
Get your report
HTML, Markdown, JSON, and SARIF reports. Findings show up in GitHub Security tab. Fail CI on critical bugs.
Run it again
breakit remembers what it found before. Next run, personas hunt for new bugs only — no duplicate noise.
Confused Grandma
Misclicks everythingMisreads labels, clicks the wrong button, fills "email" into the phone field. Finds UX issues your team is blind to.
Form Abuser
Breaks all inputsXSS payloads, SQL injection, 10,000-character inputs, empty submits, unicode bombs. The pentester your forms deserve.
Mobile User
Tiny viewportTiny 390px viewport. Fat-finger taps, checks responsive breakpoints, finds overlapping elements and unreachable buttons.
Impatient Teenager
Zero patienceDouble-clicks everything, navigates away mid-submit, spams the back button, rage-clicks loading spinners.
First-Time Visitor
Cold landingLands on your homepage cold. Can they figure out what you do? Find the signup? Complete onboarding? You might be surprised.
Ship with confidence
Add breakit to your deploy pipeline. Every push gets tested by AI personas that think like real users.
GitHub Action
One YAML block in your workflow. Runs on every deploy, fails on critical bugs.
- uses: petr-kin/breakit@v1
with:
url: ${{ env.DEPLOY_URL }}
api-key: ${{ secrets.GEMINI_API_KEY }}
severity-threshold: highSeverity gating
Exit code 2 when verified findings meet your threshold. Only high-confidence bugs fail your build.
npx breakit test https://staging.app.com \
--severity-threshold highNovelty tracking
SQLite corpus remembers past findings. Personas focus on new bugs, not re-reporting known ones.
# First run: finds 5 bugs
npx breakit test https://app.com
# Second run: hunts for NEW bugs only
npx breakit test https://app.comSARIF reports
Findings appear in GitHub Security tab alongside CodeQL and Dependabot alerts.
npx breakit test https://app.com --sarif
# Uploads via codeql-action/upload-sarifConfig files
Persist settings per project. Credentials stay in env vars, never in config.
// breakit.config.json
{
"url": "https://staging.app.com",
"severityThreshold": "high",
"credentials": {
"password": "from-env:TEST_PASS"
}
}Zero cost to start
Gemini free tier. No account, no signup, no credit card. Just an API key and a URL.
export GEMINI_API_KEY=...
npx breakit test https://your-app.comWatch 5 personas
test at once
Each persona runs in its own browser, finding different classes of bugs simultaneously.
$ breakit run https://demo-app.comClicked "Deploy to Production" thinking it sends an email
Injected <script>alert(1)</script> in bio field — it rendered!
Navigation menu overlaps content at 390px viewport
Double-clicked "Submit" — form submitted twice, duplicate entry
Could not find pricing page from homepage — no nav link
Pasted 50,000 chars into "Name" field — page froze for 4s
Typed phone number in email field, got cryptic "ERR_VALIDATION"
Hit back button during checkout — cart emptied, no recovery
Tap target for "Delete Account" is only 24x24px
Signup flow has 7 required fields with no progress indicator
Empty form submission returns 500 Internal Server Error
Clicked logo expecting to go home — nothing happened
Rage-clicked loading spinner 12 times — spawned 12 API calls
Horizontal scroll on /settings — content overflows viewport
"Get Started" redirected to login with no signup option visible
SQL injection in search: ' OR 1=1-- returned all users
Clicked "Deploy to Production" thinking it sends an email
Injected <script>alert(1)</script> in bio field — it rendered!
Navigation menu overlaps content at 390px viewport
Double-clicked "Submit" — form submitted twice, duplicate entry
Could not find pricing page from homepage — no nav link
Pasted 50,000 chars into "Name" field — page froze for 4s
Typed phone number in email field, got cryptic "ERR_VALIDATION"
Hit back button during checkout — cart emptied, no recovery
Tap target for "Delete Account" is only 24x24px
Signup flow has 7 required fields with no progress indicator
Empty form submission returns 500 Internal Server Error
Clicked logo expecting to go home — nothing happened
Rage-clicked loading spinner 12 times — spawned 12 API calls
Horizontal scroll on /settings — content overflows viewport
"Get Started" redirected to login with no signup option visible
SQL injection in search: ' OR 1=1-- returned all users
Get early access.
Be the first to know when breakit.dev launches. Free during beta.