Test files exist for critical application paths
Why it matters
AI-built projects that ship without tests accumulate risk with every change. There is no safety net when modifying working code — a refactor that breaks authentication or payment processing goes undetected until a user reports it. ISO 25010 maintainability.testability directly measures this gap. SSDF PW.8 requires testing as a software assurance control. The absence of tests is especially costly in AI-assisted development where the model makes structural changes across sessions that can silently break previously working behavior.
Severity rationale
High because untested critical paths — authentication, payments, data validation — have no automated regression detection, making every future change a gamble against undetected breakage.
Remediation
Start with the highest-value tests: critical business logic and API route behavior. Set up a test runner:
npm install -D vitest @vitest/coverage-v8
# or: npm install -D jest @types/jest ts-jest
Write your first test covering the most critical logic path:
// tests/lib/scoring.test.ts
import { computeCategoryScore } from '../lib/scoring'
describe('computeCategoryScore', () => {
it('returns null when all checks are skipped', () => {
const checks = [{ result: 'skip' }, { result: 'skip' }]
expect(computeCategoryScore(checks)).toBeNull()
})
})
Five targeted tests covering auth, payments, and core logic are more valuable than fifty snapshot tests of static UI components.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Code Maintainability Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.testability — Testability
- ssdf:800-218 · PW.8 — Test Executable Code
- soc2:2017 · CC8.1 — Change management
Taxons
History
- 2026-04-18·v1.0.0·Initial import from code-maintainability·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (CC8.1) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2