Basic code coverage analysis should catch that add_these doesn't have full branch coverage. Additionally, some fuzzing tools can actually to branch analysis an

Basic code coverage analysis should catch that add_these doesn't have full branch coverage. Additionally, some fuzzing tools can actually to branch analysis and target your "rare" codepaths. Now, sure, figuring out how to hit some codepaths basically requires brute force - it's not going to magically figure out an efficient way to collide SHA1s if that's what it takes for your test to fail - and you need a way to differentiate good from bad behavior (this might be a reference implementation, or this might be as simple as "does it crash?") - but you do have to get crazier than add_these before you hit the limits of even existing tooling to catch bugs.