API Spec Drift Check — Does Your README Still Match Your Routes?
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.
What the issue is
A README that documents routes the app does not have, and an app that ships routes the README never mentions, makes the spec the unreliable one. Every integrator and future tool that trusts the doc hits a wall.
Why AI tools generate it
Agents update the code to make the demo work and rarely revisit the README afterward. Routes are renamed, moved, and added on every iteration while the documented paths freeze at whatever the first answer said.
How DevMeth detects it
The scan parses route claims from your README (from backticked paths and text inside API-related sections), builds the real route inventory from your app files, canonicalizes dynamic segments, and reports both directions of mismatch.
Your README documents API routes that don't exist — and ships routes nobody documented
WHAT WE FOUND
README.md — documents POST /api/notifications — the route does not exist
The fix, in three steps
Implement or delete each claimed-but-missing route, add each existing-but-undocumented route to the README, and re-check the path spellings. The report drives this with the exact diff of claims versus reality.
Run a free scan and each finding carries a paste-ready fix prompt you can act on.
Maintainability findings ship in the Rescue Report — bundled with the Launch Pack or available on its own.
Try a free scanFAQ
Which file counts as the spec?
The scan reads the README at the project root. If your API docs live elsewhere, that is itself a decision worth making explicit — the README is what most integrators and tools read first.
How are dynamic segments compared?
`/api/users/[id]` and `/api/users/:id` normalize to the same route, so renaming a param does not produce a false drift finding.
Is documenting every route really necessary?
Not necessarily — the scan only flags routes missing from a README that demonstrably lists routes. If the README never tries to inventory the API, there is nothing to diff and nothing fires.
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.