Boundaries
What does AppTruth not check?
AppTruth does not test live runtime behavior, external configuration, deployed infrastructure, or provide exhaustive security coverage.
Reviewed by Uriel from AppTruth · Updated · 3 min read
Direct answer to “What does AppTruth not check?”
AppTruth does not directly test a running app, live service responses, secrets, external account configuration, or deployed infrastructure. It also does not claim exhaustive source coverage, execute tests, or replace security, performance, accessibility, compliance, and production-monitoring tools.
Key points: What does AppTruth not check?
- Standard scans review the default branch as static source.
- External state and runtime-only behavior require separate verification.
- Coverage limitations are recorded rather than hidden.
Runtime and environment boundaries
AppTruth does not launch a browser, deploy the repository, call live APIs, submit payments, send transactional email, or mutate a database. It cannot confirm that a deployed environment uses the same commit, environment variables, secrets, permissions, dashboards, or network policies represented by the reviewed code.
- Live staging and production behavior
- Third-party service availability and account settings
- Runtime-only data, race conditions, and network failures
- Performance, load, browser compatibility, and visual correctness
Repository and file boundaries
A standard scan focuses on the selected repository’s default branch. Installed dependencies, generated output, lockfiles, binaries, source maps, large structured fixtures, symlinks, submodules, and potentially sensitive files can be excluded. Unsupported languages, failed parses, unresolved imports, dynamic behavior, and size limits can also reduce coverage.
Assurance boundaries
An AppTruth result is not a security certification, legal review, privacy impact assessment, compliance attestation, penetration test, accessibility audit, or guarantee that an application is defect-free. The strongest use of AppTruth is to make behavior and uncertainty visible so the right specialist checks can follow.
Which specialist checks remain outside AppTruth
| Question | Use instead | Why |
|---|---|---|
| Is it exploitable? | Security testing | Requires dedicated threat and runtime evidence |
| Is it accessible? | WCAG-based audit | Requires interaction, semantics, and assistive-technology review |
| Will it handle load? | Performance testing | Requires representative execution and measurement |
| Is it compliant? | Legal and control assessment | Requires scoped obligations and formal evidence |
The KNOWN / UNKNOWN Ledger
A release discipline for recording what source review establishes and what still needs proof.
- Known: Write the source-backed behavior and file evidence.
- Boundary: Record omitted files, unresolved paths, and static-analysis limits.
- Unknown: List live configuration, external state, and runtime behavior not observed.
- Owner: Assign each important unknown to a test or specialist review.
Trusted sources that inform this guide
These independent sources support the surrounding verification practices. AppTruth-specific product statements are product guidance and should be confirmed against current account or contractual documentation when formal assurance is required.
- Application Security Verification Standard — OWASP. Provides a dedicated basis for testing technical application security controls.
- Web Content Accessibility Guidelines (WCAG) Overview — W3C Web Accessibility Initiative. Defines the international accessibility guidance that requires its own testing and review.
- AWS Well-Architected Framework — Amazon Web Services. Frames operational excellence, security, reliability, performance, cost, and sustainability as distinct review areas.
Related questions about “What does AppTruth not check?”
Does AppTruth test accessibility or performance?
No. It may identify relevant implementation paths, but accessibility and performance require their own standards, tools, and runtime evidence.
Does a clean scan guarantee the app has no defects?
No. Static coverage is partial by nature, and many failures depend on live data, configuration, timing, networks, browsers, or third-party services.