The machines that check the machine's work showed up.

An agent-powered vulnerability scanner you run in your own infrastructure, from Vercel Labs — the org's second appearance here in two editions (just-bash, Thursday). The pipeline is the design: scan finds candidate sites with regex matchers (fast, no AI), process sends coding agents at maximum thinking levels to investigate each one, revalidate re-checks findings against git history to cut the false-positive rate, and process --diff scans only a PR's changed files — the verification gate, wired for CI. Large repos fan out across Vercel Sandbox microVMs, and interrupted runs resume where they stopped. Even the onboarding is agent-native: you bootstrap it by telling your own coding agent to read the tool's SKILL.md — Thursday's vendor-published-onboarding thread, now running in the security layer. Apache-2.0, 5,995 stars, created April.

Reach for it when the codebase is big enough to have corners no reviewer has re-read in years — the long-lurking bugs it's explicitly aimed at. Delete the SAST config that cries wolf four hundred times per scan and gets ignored accordingly. Tradeoff: the README states plainly that full scans on large codebases "can cost thousands or even tens-of-thousands of dollars" — your Claude Max subscription is enough to evaluate it, not to run it — and deepsec is itself a coding agent with shell access, so vendored dependencies are a prompt-injection surface; their sandbox mode, with keys injected outside the box and egress pinned to the agent hosts, is the stated mitigation.

A hosted QA agent from Replay.io, the time-travel-debugging company, launched today at #3 on Product Hunt (195 votes): point it at a URL for a one-shot check or connect the GitHub repo for continuous runs, and it explores your app on its own, records every session, flags real breakage, and emits root-cause analysis with suggested fixes formatted for a coding agent to act on. This is Friday's watch landing from an incumbent — Sentinel and Libretto launched the code-aware-QA and self-healing-test ideas as Show HNs; Replay brings years of record/replay infrastructure, which is why the bug report arrives with the receipts attached instead of a screenshot and a guess. The maker is explicit that fixes route through your normal review and test workflow: the agent files evidence, it doesn't push.

Reach for it when your test suite covers what you thought to test and users keep finding the rest — the staging deploy nobody clicks through anymore. Delete the pre-release click-around ritual and the smoke tests that only assert the happy path. Tradeoff: hosted and closed — you're handing an autonomous browser your staging app and its recorded sessions — and it's free with no published pricing, which means the bill is a later chapter; whatever its exploration doesn't wander into stays exactly as unverified as before.

A Go CLI that moves the run somewhere auditable: crabbox run -- pnpm test leases a remote machine (Hetzner, AWS, Azure, GCP, Daytona, or your own SSH host), rsyncs your dirty working tree, runs the command, streams output back, and records the evidence — logs, artifacts, and run history from the exact box that ran it. An optional coordinator (Cloudflare Workers Durable Object, or Node plus Postgres) owns the cloud credentials, serializes leases, and enforces monthly spend caps, so no long-lived provider keys sit on laptops. Provenance is the story: this ships from the OpenClaw org — the 383,000-star personal-agent project — and its named audience includes "AI agents and other automation that need command output, logs, artifacts, and run history from an auditable remote box." When the agent says the suite is green, this is the box that can prove it. MIT, 1,192 stars, created April.

Reach for it when "works on my machine" now includes machines an agent controls — or when fleet test runs need spend caps and an audit trail more than they need another bespoke CI job. Delete the SSH-and-pray script and the CI workflow you clone for every experimental branch. Tradeoff: the trust model is stated with unusual clarity and it is the opposite of a sandbox — repository config is executable automation, runners assume a cooperative team, and nothing here is an isolation boundary between adversarial tenants; bring your own paranoia.

A public wall-clock leaderboard for fine-tuning technique: LoRA-tune Qwen2.5-1.5B to at least 57% on GSM8K on a single L40S, lowest training time wins — and no record enters the table until it's been re-run three times with fresh seeds on identical Modal hardware. Attempting and verifying are both free (Modal's monthly credits cover full runs), so anyone can compete and anyone can re-check any record with one command. The author's framing names the gap exactly: DoRA, rsLoRA, PiSSA, LoRA+, NEFTune all report numbers on different models, data, and hardware, so nothing is comparable; the nanoGPT speedrun fixed that for pretraining and produced Muon, and this is the same arena for the fine-tuning people actually do. A second track (SmolLM2-1.7B on SQuAD) landed this morning. MIT, created Saturday, 87 stars, 88 points on the front page.

Reach for it when you're picking fine-tuning tricks off self-reported paper numbers — or when you have a technique and want a result nobody can argue with. Delete the bookmarks folder of PEFT papers with mutually incomparable baselines. Tradeoff: it's two days old and every current record belongs to the author, so the arena has exactly one gladiator — and "independently re-run" today means re-run by the project's own harness, which is a protocol for trust, not yet a community supplying it.

Off the thread but worth knowing: openship was the day's biggest mover (1,719 stars today, 3,926 total, Apache-2.0, created March) — an npm-installable, self-hosted deployment platform with built-in CI/CD and a desktop app, working the self-hosted-Vercel lane Coolify opened. transcribe.cpp (1,042 stars, MIT) and Moonshine Voice (9,437 stars, MIT, established October 2024) trended the same day — a ggml speech-to-text engine covering 16 model families, and a full on-device voice toolkit claiming above-Whisper accuracy; the local voice stack is consolidating, and even here the receipts culture shows: transcribe.cpp ships every model port "numerically verified and WER-tested against its reference implementation." browser-use/video-use re-trended (17,323 stars, MIT; first crossed our pool 06-28) — drop footage in a folder, chat with Claude Code, get final.mp4 back — and it self-evaluates the rendered output at every cut boundary, which is today's theme arriving in video editing. And pleasedonotescape.com is a filterable catalog of AI agent jails — the sandbox shelf we've been stocking since 06-18 now has an index.