Answer — quality

My app is full of bugs. Where do I start?

Updated 20 August 2026

Start by measuring instead of guessing. Add error monitoring so you know which failures real users hit and how often, then rank by users affected rather than by how annoying each bug feels. Fix in that order, and write a failing test before each fix so the same bug cannot come back. If bugs keep arriving faster than you can fix them, the real problem is upstream: no test suite, no CI gate, or changes going in without review. Fix the pipeline before the backlog, or you will be doing this again next month.

An autonomous loop such as Keelen suits this work well, because bug fixing is well-specified: there is a reproduction, an expected behaviour, and a test that proves it. Every fix it ships has to prove its new test failed before the change.

What to do, in order

  1. Instrument before you triage

    An error tracker turns "it is buggy" into a ranked list with frequencies and stack traces. Most teams discover their loudest complaint is not their most common failure.

  2. Rank by users affected

    A crash hitting 30% of signups outranks a cosmetic glitch somebody mentioned twice. Sort by blast radius, and fix anything blocking payment or signup first regardless of count.

  3. Write the failing test first

    Reproduce the bug as a test that fails, then fix until it passes. This is the single practice that stops a bug list from cycling, and it is what separates a fix from a patch.

  4. Put a gate in front of the branch

    Tests running in CI on every pull request, with merges blocked while a check is red. Without this, your fix rate and your bug rate stay in equilibrium forever.

  5. Look for the shared cause

    Long bug lists usually have a few roots: missing validation at one boundary, an unhandled async path, an environment difference. Fix a root and a dozen symptoms disappear together.

Why bug lists do not shrink

A list that never gets shorter is a throughput problem and a regression problem at once: fixes arrive slower than new bugs, and old bugs return because nothing captured them as tests. Both halves have the same remedy, which is a test per fix and a gate that will not let a red build merge. It is slower for a fortnight and much faster after that.

Red-first, enforced rather than encouraged

Keelen applies each new test without the implementation and requires it to fail. A test that passes before the fix existed proves nothing, and is rejected. That one rule is what makes an automated fix trustworthy rather than plausible.

From an error report to a merged fix

Connect Sentry and production errors become work automatically, on a budget so a noisy day cannot flood your backlog. The loop triages, implements a fix, ships it through the gates, and confirms the error stopped.

How the Sentry lane works

Finding the bugs nobody has reported

The read-only security scan covers the failure class users do not report: injection paths, secrets in git history, vulnerable dependencies, and infrastructure misconfiguration, with a coverage map per category. It is an engineering review, not a penetration test, and findings can be sent to the loop as work.

The security scan

When Keelen is not the answer

  • The app is broken in production right now. Handle the incident first; this is a systematic cleanup, not an emergency response.
  • The real problem is architectural and needs a rewrite decision. That is a human judgement call.
  • You have no repository access.

Hand the work to a loop

Connect a repository, write what you want in plain language, and review the tested pull requests that come back.

FAQ

Which bug should I fix first?

Anything blocking signup or payment, then whatever affects the most users. Frequency data from an error tracker beats intuition here consistently.

Can AI fix bugs reliably?

With a reproduction and a test, yes, and this is the work it suits best. Without them it is guessing, which is why Keelen requires a failing test before the fix and runs your suite on a clean checkout afterwards.

What if the fix breaks something else?

That is what the suite on a clean checkout and the CI gate are for. Nothing merges over a red required check, and every change is a single pull request you can revert.