Get direct, source-backed answers about app behavior audits, launch readiness, authentication, billing, scan coverage, and the limits of static review.
Updated
Product overview
AppTruth is an AI-powered app behavior verification platform. It reviews an approved GitHub repository, maps the product behaviors supported by the code, and returns evidence-backed findings in plain language so builders can understand what their app actually does.
Category
AppTruth belongs to the AI app verification category. More specifically, it is an AI-powered application behavior audit and production-readiness review tool for software built with traditional or AI-assisted development workflows.
Audience
AppTruth is for anyone responsible for understanding or releasing an app: solo founders, vibe coders, AI-assisted developers, product managers, QA professionals, engineering leads, and agencies reviewing client software.
Coverage
AppTruth can review behavior represented in a connected repository across frontend code, backend APIs, authentication and authorization, database access, payments, email, cloud configuration, background work, and error handling.
Connections
AppTruth currently uses a direct, read-only GitHub connection for repository scans. From that approved source, it can analyze code and configuration that integrate services such as Supabase, Stripe, Vercel, Clerk, Resend, AWS, Firebase, and Sentry.
Environments
AppTruth does not directly log into staging, test, or production environments during a standard scan. It reviews the selected repository’s default-branch source, so it can analyze environment-specific logic present in code without testing the live environment itself.
Trust
Yes. AppTruth’s repository scan access is read-only. It can read approved repository code and metadata, but it cannot push commits, edit files, change repository settings, or delete code.
Boundaries
No. AppTruth is not a dedicated security scanner. It may identify security-relevant application behavior, such as missing access checks, but it does not replace SAST, DAST, dependency scanning, penetration testing, or a security review.
Method
No. AppTruth does not execute a repository’s test suite or run the application during a standard scan. It performs static analysis of approved source code and may read test files when they provide useful behavior context.
Workflow
AppTruth is currently on-demand. A user chooses an approved GitHub repository and explicitly starts a scan when they want a fresh behavior review.
Data practices
AppTruth retains the account, integration, repository, billing, support, and scan-result records needed to provide the service. Prepared source artifacts and internal analysis artifacts are stored in encrypted private storage with a 30-day lifecycle; normalized scan results remain available in scan history until removed under applicable account and data processes.
Results
An AppTruth scan produces a structured behavior report. Each finding can include a plain-language behavior, confidence score, impact level, likely cause, affected areas, file-based evidence, and an implementation-ready remediation prompt.
Boundaries
AppTruth does not directly test a running app, live service responses, secrets, external account configuration, or deployed infrastructure. It also does not claim exhaustive source coverage, execute tests, or replace security, performance, accessibility, compliance, and production-monitoring tools.
Company
AppTruth is an independently operated software product. Product communications and customer support are led by Uriel from AppTruth, reachable at uriel@apptruth.io and through signed-in support.
Trust
Users can request AppTruth’s current security and privacy documentation through the signed-in support area or by emailing uriel@apptruth.io. Public policy links should be treated as authoritative once they are published on apptruth.io.
Launch guide
To audit an AI-generated app before launch, define the critical user journeys, trace each journey through source code, verify access and side effects, test the highest-risk flows in a realistic environment, and record unresolved gaps with an owner. AppTruth can provide the source-based behavior map; runtime and specialist tools provide the remaining evidence.
Checklist
A vibe-coded app release checklist should require evidence for the intended user journeys, server-side authorization, data handling, billing state, error recovery, runtime tests, security checks, accessibility, monitoring, backups, deployment parity, and rollback. Treat generated code as implementation to verify, not proof that the product requirement is satisfied.
Comparison
AppTruth explains source-backed product behavior across a repository. Code review evaluates implementation quality and change intent; automated tests execute encoded assertions; security scanners look for risk patterns or exploitable behavior; observability reports live-system telemetry. Teams use them together because no method produces all of those evidence types.
Verification guide
Verify authentication and authorization by inventorying identities and roles, tracing every protected action from interface to server and data layer, confirming permissions are enforced server-side, and testing allowed, denied, expired, revoked, and cross-tenant cases in a realistic environment. Source review finds the control paths; runtime tests prove they behave correctly.
Billing guide
Verify Stripe subscription behavior by tracing checkout to the server-created billing object, validating webhook signatures, making event handling idempotent, mapping subscription states to product entitlements, testing retries and out-of-order events, and reconciling local state with Stripe. Source review maps the flow; Stripe test mode and event tooling provide runtime proof.
Release readiness
An app behavior audit is a pre-launch review that compares what the product is supposed to do with what the implementation supports. It traces critical journeys across source, records evidence and uncertainty, and identifies the runtime or specialist checks still needed before release.