I let a frontier model audit my npm package - it found 16 bugs in 400 lines

I built slopsieve, a zero-dep Node CLI that scores a diff or PR for the hygiene signals reviewers check by hand. Before tagging v0.2.0, I ran an adversarial audit of the full source with a frontier model in high-thinking mode.

The findings were real, not theoretical:

1. diff -u output (no diff --git header) parsed to zero files. The tool reported a confident, completely false 0/100.
2. A removed line -- i; inside a hunk (a C decrement) was consumed as a file header and corrupted the path.
3. --fail-at without a value silently became NaN and the gate never fired.
4. Any package.json version bump counted as "new dependency for a small diff".
5. test.each parameterization that kept coverage intact was scored as assertion removal.
6. JSDoc @param/@returns tagged as commented-out code.
7. catch {} with no parameter (valid ES2019) escaped detection.
8. Reordered code was classified as whitespace-only churn because I sorted lines before comparing.

All 16 are fixed, each with a regression case. The tool now scores its own diff 0/100 and correctly lints itself, which is how I found out my test file literally contains strings that look like the slop it tests for (fixed with per-file slopsieve-ignore markers, eslint-disable style).

What shipped alongside the fixes: secrets-in-diff detection with redacted evidence, phantom-import checks against the actual checkout, --format github for Actions annotations, .slopsieverc.json, git range and --staged scoring, generated-file and lockfile exclusion.

The lesson I keep relearning: happy-path parsing is where tools like this quietly lie to you. My parser handled diff --git beautifully and reported a confident clean score on input it did not understand at all.

repo: https://github.com/princejain756/slopsieve

what's the worst silent-failure bug a linter has ever handed you?