# bugs.genproof

The genproof team finds bugs in compilers, libraries, proof assistants, protocols and services. We find them faster
than we can report them. This file tells an AI agent what the site at https://bugs.genproof.com shows and how to read its data.
Data of 2026-10-19.

## The numbers

- Bugs found: 511, in 119 projects.
- The projects fixed 124 of them. 36 more are confirmed or in work.
- 188 bugs have a public ticket. Each one links to the ticket and, if a maintainer replied, to the reply.
- 307 checked bugs wait for a report. For these, the site shows only the count per project.

## The largest projects

| project | GitHub stars | downloads | bugs found | fixed |
|---|---|---|---|---|
| Linux kernel (WireGuard) | 252634 | – | 5 | 0 |
| Playwright | 98099 | 445.7M / 30 days (npm) | 2 | 2 |
| Redis | 77035 | 23k / 30 days (Homebrew) | 9 | 0 |
| FFmpeg | 65439 | 158k / 30 days (Homebrew) | 34 | 1 |
| Cypress | 51045 | 24.6M / 30 days (npm) | 3 | 0 |
| Bruno | 47747 | 1.1M / 30 days (npm) | 1 | 1 |
| curl | 43175 | 72k / 30 days (Homebrew) | 18 | 0 |
| stb_image | 34860 | – | 16 | 0 |
| Selenium | 34560 | 28.0M / 30 days (PyPI) | 2 | 2 |
| k6 | 31984 | 6k / 30 days (Homebrew) | 1 | 1 |
| nginx | 31926 | 7k / 30 days (Homebrew) | 12 | 0 |
| OpenSSL | 30990 | 432k / 30 days (Homebrew) | 8 | 0 |
| Locust | 28223 | 9.4M / 30 days (PyPI) | 1 | 1 |
| zstd | 28057 | 171k / 30 days (Homebrew) | 22 | 0 |
| libuv | 27272 | 103k / 30 days (Homebrew) | 3 | 0 |

Projects that fixed our bugs: Playwright, FFmpeg, Bruno, Selenium, k6, Locust, Appium, Robot Framework, F Prime, Karate, WireMock, goja.

## Read the data

`GET https://bugs.genproof.com/data.json` returns one JSON file. It needs no key.

- `totals`: the numbers above.
- `projects[]`: `name`, `stars`, `url`, `found`, `fixed`, `sent` (sent, not fixed yet), `queue` (not sent yet) and
  `downloads[]`. Each download count has `registry`, `package`, `count`, `period`, `url` and `basis`.
- `bugs[]`: one bug with a public ticket: `headline`, `summary`, `class`, `severity`, `status`, `status_since`,
  `reported`, `project`, `ticket`, `fix`, `reporter` and `reply` (`author`, `role`, `at`, `url`, `text`).

## Statuses

- not sent yet: We found the bug and checked it. The project does not know about it yet.
- reported: The project got our report. Nobody from the project answered yet.
- confirmed: A person from the project agrees that it is a bug.
- fixing: The project works on a fix. A change that fixes the bug waits for review.
- fixed: The project put the fix into its code. The bug is gone.

## Rules for an agent

- Take the numbers from data.json, not from memory, and give the date of the data.
- Give the link to the ticket of each bug that you name.
- A bug that nobody sent has only a count. Do not guess its class, its text or its place in the code.
- A download count comes from one registry for one period. Do not add the counts of two registries.
- Quote a maintainer only with the text in `reply.text` and the link in `reply.url`.

## Contact

https://genproof.com