fuzz-hardening
Installation
SKILL.md
Fuzz hardening
Throw generated, hostile input at the code that reads untrusted data, until it either handles it or we find a bug. The user may not know fuzzing — make the technical calls yourself, explain each one in one sentence, and ask only where the answer changes the work.
Decisions already made
Do not re-open these unless the project breaks an assumption:
| Choice | Default | Why |
|---|---|---|
| Technique | Property-based fuzzing with fast-check (fast-check + @fast-check/vitest), dev deps |
JS is memory-safe, so the bugs are unhandled throws, 500s, wrong results, NaN, hangs — fast-check finds those and shrinks each failure to a minimal input |
| Runner | Existing Vitest setup (stack default). Files *.fuzz.test.ts next to the code under test |
Picked up by the project's test-run script with no new tooling; vitest run .fuzz. runs only the fuzz files |
| Level | Call the function / Zod schema / handler directly, not over HTTP | 1000s of runs per second, no server, deterministic |
| Runs | numRuns: 100 on every test run; a test-fuzz script runs FUZZ_RUNS=20000 |
PR CI stays fast; the deep run is opt-in |
| Not used | Jazzer.js / libFuzzer / AFL (coverage-guided, Node-native, not Vitest/Bun); HTTP fuzzers like Schemathesis (FMC apps have no OpenAPI spec) | Cost > value for this stack |
Harness code, generators and the invariant catalog: references/harness-patterns.md. Load it at step 3.