testpal-ai

v7.1.2

Published

4 months ago

TESTPAL v7.1 - AI-Powered Testing Agent with Hardened Security, Git History Verification, Multi-Factor Confidence, 30+ Secret Patterns (HuggingFace, Anthropic, AWS, etc.), Framework-Aware Analysis, 95%+ accuracy. Created by Akash S

Downloads

🧪 TESTPAL v7.1.0 - AI-Powered Testing Agent

Framework-Aware Security Analysis | 95%+ Accuracy | Zero False Positives

Created by: Akash S (AI Engineer)

"The only testing tool that understands your framework and learns from its mistakes."

🎯 Why TESTPAL?

Traditional security tools flag everything. TESTPAL understands context.

// ❌ Other Tools: "SQL INJECTION DETECTED!"
// ✅ TESTPAL: "This is JSX. It's safe."
<button aria-label={`Click ${count} times`}>Click</button>

// ✅ Other Tools: Miss this
// ✅ TESTPAL: "CRITICAL: HuggingFace token exposed!"
const HF_TOKEN = "hf_xxxxxxxxxxxxx";

The Problem We Solve

SonarQube: 40% false positives on React projects
Snyk: Doesn't understand JSX template literals
ESLint: No framework-aware security rules
Manual Review: Time-consuming and error-prone

The TESTPAL Difference

✅ Framework Intelligence - Detects React, Vue, Express, Next.js
✅ Database-Aware - Only flags SQL injection if you have a database
✅ 30+ Secret Patterns - HuggingFace, Anthropic, AWS, Stripe, etc.
✅ Git Security - Scans history for accidentally committed secrets
✅ Multi-Factor Confidence - Context-based scoring system
✅ Self-Learning - Remembers false positives and improves

🚀 Quick Start

Installation

# Global installation (recommended)
npm install -g testpal-ai

# Local installation
npm install --save-dev testpal-ai

Basic Usage

# Interactive mode (easiest)
testpal

# Analyze current directory
testpal analyze .

# Analyze specific project
testpal analyze /path/to/project

# Test live website
testpal url https://example.com

# Full project test (with runtime)
testpal test .

Your First Analysis

cd your-react-app
testpal analyze .

# Output:
# 🧠 Framework-Aware Analysis
# 📦 Project Type: frontend-only (React)
# 🗄️ Database: None detected (SQL checks disabled)
# 📁 Analyzing 234 code files...
# ✅ Smart Analysis complete
#
# 🔒 SECURITY ISSUES FOUND: 3
#   🔴 CRITICAL: 0
#   🟠 MAJOR: 2
#   🟡 MINOR: 1

🧠 Smart Features

1. Framework Intelligence

Automatically detects your stack and applies relevant rules:

// ✅ Detected: React + TypeScript (Frontend-only)
// - SQL injection checks: DISABLED
// - XSS checks: ENABLED
// - React-specific rules: ENABLED

// ✅ Detected: Express + PostgreSQL (Fullstack)
// - SQL injection checks: ENABLED
// - CSRF protection: ENABLED
// - Rate limiting: CRITICAL priority

2. Git Security Verification (NEW in v7.1)

Scans your entire git history for exposed secrets:

🔒 Running Git Security Verification...
⚠️ Found 2 Git security issues

CRITICAL: .env file found in git history!
└─ Fix: Rotate ALL keys immediately!
   Run: git filter-repo --path .env --invert-paths

MAJOR: .env is NOT in .gitignore
└─ Fix: Add ".env*" to .gitignore

3. 30+ Secret Detection Patterns

Catches API keys you didn't know you exposed:

// ✅ Detects all of these:
HUGGINGFACE_TOKEN=hf_xxxxx          // HuggingFace
ANTHROPIC_API_KEY=sk-ant-xxxxx     // Claude AI
OPENAI_API_KEY=sk-xxxxx            // OpenAI
AWS_SECRET_ACCESS_KEY=xxxxx        // Amazon
STRIPE_SECRET_KEY=sk_live_xxxxx   // Stripe
GITHUB_TOKEN=ghp_xxxxx             // GitHub
DATABASE_URL=postgres://user:pass  // Database credentials
... and 23 more patterns!

4. Multi-Factor Confidence Scoring

Not just pattern matching - contextual intelligence:

Confidence Score = 
  Pattern Match (40%) 
  + Context Validation (25%) 
  + Framework Awareness (20%) 
  + File Type Relevance (15%)

Example:
├─ SQL in JSX file: 5% confidence (false positive)
├─ SQL in backend with no DB: 20% confidence
├─ SQL in backend with Prisma: 60% confidence (ORM handles it)
└─ Raw SQL concatenation: 95% confidence (REAL ISSUE)

5. False Positive Learning

Mark issues as false positives once, never see them again:

# Mark false positive
testpal learn false-positive SEC-003 "This is a JSX template"

# Suppress a rule globally
testpal learn suppress SEC-007

# Inline suppression
// testpal-ignore SEC-003
const query = `SELECT ${safeColumn} FROM users`; // Actually safe

📊 Detection Rules

🔴 CRITICAL (10 Rules)

API keys exposed in code (30+ patterns)
Hardcoded credentials
.env files tracked in git
Secrets in git history
Exposed database URLs
JWT/Session secrets

🟠 MAJOR (15 Rules)

SQL injection (context-aware)
XSS vulnerabilities
Unprotected API endpoints
CSRF missing
Insecure localStorage (tokens)
console.log with sensitive data
Rate limiting missing
Prompt injection (LLM apps)
N+1 query problems

🟡 MINOR (25 Rules)

Loose equality (== vs ===)
console.log in production
TODO/FIXME comments
Empty catch blocks
Missing error boundaries (React)
Long functions
Code quality issues

🏗️ Architecture

testpal-ai/
├── bin/
│   ├── testpal.js          # CLI entry point
│   └── testpal-test.js     # Main test runner
├── lib/
│   ├── testpal-brain.js    # Core analysis engine (50+ rules)
│   ├── framework-intelligence.js  # Detects frameworks/databases
│   ├── git-security-checker.js    # Git history scanning (NEW)
│   ├── false-positive-learning.js # ML feedback system
│   ├── project-detector.js        # Auto-detect project type
│   ├── runtime-manager.js         # Start/stop dev servers
│   ├── browser-automation.js      # Puppeteer testing
│   ├── url-analyzer.js            # Website security analysis
│   └── report-generator.js        # Human-quality reports
└── testpal/
    ├── cases/              # Test case database
    ├── examples/           # Example outputs
    └── templates/          # Report templates

🔧 Advanced Usage

Analyze Specific Files

testpal analyze src/components/**/*.jsx
testpal analyze backend/api/**/*.js

Full Project Testing (with Runtime)

# Auto-detects project type, starts server, runs tests
testpal test .

# What it does:
# 1. Detects React/Vue/Express/Next.js
# 2. Starts dev server (npm start / yarn dev)
# 3. Runs static analysis
# 4. Browser automation tests
# 5. Security checks
# 6. Generates comprehensive report
# 7. Stops server gracefully

Website Analysis

# Quick scan
testpal url https://example.com

# Full crawl (slower but thorough)
testpal url https://example.com --full

# Checks:
# - XSS vulnerabilities
# - CORS configuration
# - CSP headers
# - Cookie security
# - SSL/TLS
# - Performance metrics
# - SEO issues
# - Accessibility (WCAG)

Learning Commands

# View statistics
testpal learn stats

# Mark false positive
testpal learn false-positive <ruleId> "Reason"

# Suppress rule globally
testpal learn suppress <ruleId>

# Export learnings
testpal learn export learnings.json

# Import learnings
testpal learn import learnings.json

📈 Accuracy Metrics

| Metric | Before v7.0 | After v7.1.0 | |--------|-------------|--------------| | False Positive Rate | 33% | <5% | | True Positive Rate | 72% | 94% | | Framework Detection | 0% | 95% | | Secret Detection | 12 patterns | 30+ patterns | | Overall Accuracy | 6/10 | 9/10 |

🤝 Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

Development Setup

git clone https://github.com/akashs/testpal-ai.git
cd testpal-ai
npm install

# Run tests
npm test

# Local testing
node bin/testpal.js --version

Adding New Rules

// In lib/testpal-brain.js
{
    id: 'SEC-XXX',
    severity: 'critical',
    message: 'Description of issue',
    fix: 'How to fix it',
    baseConfidence: 0.9,
    fileTypes: ['javascript', 'typescript'],
    pattern: /your-regex-here/,
    exclude: (line, content, ctx) => {
        // Return true to skip this line
        return ctx.isTestFile;
    },
    requiresContext: (ctx) => ctx.hasDatabase
}

🛣️ Roadmap

v7.2 (Q1 2026)

[ ] Visual Studio Code extension
[ ] GitHub Action integration
[ ] Real-time analysis (watch mode)
[ ] Team collaboration features

v7.3 (Q2 2026)

[ ] More framework support (Svelte, Solid.js)
[ ] API for CI/CD integration
[ ] Custom rule engine
[ ] Performance optimizations

v8.0 (Q3 2026)

[ ] AI-powered fix suggestions
[ ] Automated PR generation
[ ] Enterprise features
[ ] Cloud dashboard

📝 License

MIT © Akash S

🙏 Acknowledgments

Puppeteer - Browser automation
JSDOM - HTML/DOM parsing
Axios - HTTP client
Node.js - Runtime platform

📞 Support

Issues: GitHub Issues
Discussions: GitHub Discussions
Documentation: Full Docs

🌟 Star History

If TESTPAL helped you, please ⭐ star the repo!

Made with ❤️ by developers, for developers.