Coverage
What systems can AppTruth check?
AppTruth reviews connected behavior across application code, APIs, auth, data, billing, email, infrastructure, and error handling.
Reviewed by Uriel from AppTruth · Updated · 4 min read
Direct answer to “What systems can AppTruth check?”
AppTruth can review behavior represented in a connected repository across frontend code, backend APIs, authentication and authorization, database access, payments, email, cloud configuration, background work, and error handling.
Key points: What systems can AppTruth check?
- Coverage follows code and dependency relationships, not just folders.
- A system must be represented in readable source or configuration to be analyzed.
- External accounts, secrets, and live service state are outside a standard static scan.
Cross-stack systems AppTruth can understand
AppTruth prepares relevant source, identifies entry points, and follows dependency relationships. This allows one scan to connect behavior that may begin in a page, continue through an API, read or write data, trigger billing or email logic, and handle an error elsewhere.
- Frontend routes, screens, forms, and state transitions
- Backend routes, serverless functions, jobs, and webhooks
- Identity, sign-in, roles, permissions, and access checks
- Schemas, queries, mutations, storage, and data lifecycle logic
- Subscriptions, checkout, entitlements, and payment events
- Email triggers, templates, queues, and notification flows
- Deployment manifests, infrastructure configuration, and error paths
What determines scan coverage?
Coverage depends on the repository contents, supported file types, repository size, dependency graph quality, and analysis budget. AppTruth records limitations such as unsupported languages, unresolved imports, parse failures, dynamic dispatch, truncation, and generated code instead of presenting the result as exhaustive.
Some files are intentionally excluded or deprioritized, including installed dependencies, binaries, generated output, source maps, lockfiles, structured fixture data, and potentially sensitive files. Pro scan results include a coverage view that makes important omissions easier to review.
Source visibility is not live-system access
Seeing Stripe, Supabase, AWS, or another service in source code lets AppTruth reason about how the application is written to use that service. It does not prove the live account is configured the same way. Runtime responses and deployed infrastructure should be verified separately.
Which app systems are visible in a source scan?
| System | Source evidence AppTruth can review | Not confirmed |
|---|---|---|
| Authentication | Routes, middleware, roles, and access checks | Live identity-provider settings |
| Data | Schemas, queries, policies, and lifecycle code | Production records and live permissions |
| Billing | Checkout, webhooks, entitlements, and error paths | Live Stripe configuration and event delivery |
| Infrastructure | Manifests and repository configuration | Deployed resources and secrets |
The STACK Trace
A repeatable cross-stack path for following one product action through its implementation.
- Screen: Start where the user or system initiates the behavior.
- Trigger: Follow the event into an API, job, or webhook.
- Access: Inspect identity, role, and permission decisions.
- Change: Trace data, billing, email, or external side effects.
- Keep: Record error handling, persistence, and the coverage boundary.
Trusted sources that inform this guide
These independent sources support the surrounding verification practices. AppTruth-specific product statements are product guidance and should be confirmed against current account or contractual documentation when formal assurance is required.
- AWS Well-Architected Framework — Amazon Web Services. Frames operational excellence, security, reliability, performance, cost, and sustainability as distinct review areas.
- Secure Software Development Framework (SSDF) — NIST. Defines outcome-based secure software development practices, including verification and release preparation.
Related questions about “What systems can AppTruth check?”
Can AppTruth inspect a service that is not represented in the repository?
No. A standard scan needs readable source or configuration evidence. It does not independently log into external service accounts.
Does cross-stack coverage mean every file is reviewed?
No. Coverage depends on supported source, repository size, dependency resolution, and analysis limits. Material omissions should be reviewed in the coverage report.