Buggd: building an open-source website scanner

Actual Buggd v1.1 release-candidate new-scan dashboard — Actual Buggd interface captured during an authorised scan, rather than a concept mock-up.

The problem I wanted to solve

Broken links, images that fail to load, JavaScript exceptions and confusing interactive elements can be difficult to track down across a website. Developer tooling often describes the error correctly, but leaves the site owner searching for the affected page or element.

Buggd tries to bridge that gap. A simpler explanation helps someone understand the issue; the underlying browser observation and screenshot give a developer something concrete to investigate. Both views are backed by the same scan, not two different definitions of what went wrong.

Architecture: a local CLI and a real browser

The public npm package is getbugged, launched with npx getbugged. Its buggd executable starts a Node.js application with a local Fastify HTTP service and a React/Vite dashboard. Playwright opens Chromium to inspect pages and capture evidence. Scans, screenshots and generated reports remain on the user's machine by default.

The crawler is deliberately bounded and same-origin. It tracks visited pages and the resources they reference, then records observations from page content, browser console and network activity. The tool separates potential findings from verified failures where evidence is incomplete, rather than implying every warning is definitively broken.

Buggd's live scan progress, showing crawled pages and ongoing results — The live progress view reports crawling activity and findings as the browser moves through the site.

From browser observation to understandable evidence

A useful scanner needs to explain where a problem is. Buggd connects issue categories to individual pages, affected elements, captured screenshots and browser-level detail. Its Simple mode presents readable descriptions and next steps; Technical mode exposes lower-level evidence for investigation.

I designed the review workflow so that a proposed fix is not automatically labelled resolved. Users can save their review progress, rescan the site and compare the new observations. If the next scan does not establish that a problem has gone away, Buggd avoids claiming certainty.

Buggd grouped issues screen with readable descriptions of detected website problems — Findings are grouped for simpler review, with technical evidence available when it is needed.

Buggd guided fixing interface with issue details and review actions — Guided review connects the problem, the supporting observation and the next action, rather than treating a scan as a one-off report.

Buggd highlighting an affected element in a captured page screenshot — A screenshot highlight anchors a finding to the affected element on the scanned page.

Safety was a product requirement, not a footnote

Automated interactions can have real side effects. Buggd deliberately limits its checks to recognised, cautious interactions and native form validation; it does not submit forms or attempt authenticated user journeys. Network access is constrained and scan limits are explicit.

The trade-off is intentional: some dynamic or third-party content will not be fully inspected, and blocked resources can make a screenshot look different from a normal visitor's page. Buggd surfaces those limitations instead of silently presenting a partial scan as comprehensive coverage.

Shipping the first public release

The v1.1.0 release shipped on 7 November 2026 under the MIT licence. The release candidate passed 71 unit/integration tests and 25 browser tests; earlier CI runs covered Windows, macOS and Linux on Node.js 22 and 24. The published npm package was also exercised through a clean public installation and its browser-based scan workflow.

The npm naming process added an unexpected release challenge. The original unscoped package name buggd was rejected by the registry's similarity restriction. I kept the product and installed CLI branded Buggd, but published the distribution as getbugged. That distinction kept the code, documentation and release path aligned without renaming the application.

Run it locally npx getbugged

This is a real first release, not a finished testing platform. It is not a comprehensive security, SEO or accessibility audit, and it will not catch every defect. The next work is to learn from authorised real-world scans, improve first-run clarity and make the evidence easier to act on.

Read the v1.1.0 release notes Review scope and safety limits

The five screenshots are genuine Buggd v1.1 release-candidate captures from an authorised scan of Wannabyte. They were resized and stripped of metadata before publication. Findings and blocked-resource previews should not be confused with how the scanned website normally appears.