Untested Mutating Routes Check — Do Your Write Endpoints Have Tests?
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.
What the issue is
Routes that create, update, or delete data are responsible for your write path — every lasting change to your app goes through them. Without tests, a refactor or a drive-by edit can silently break the one endpoint customers depend on.
Why AI tools generate it
AI agents demonstrate features by calling the route once in the browser, not by writing tests around it. Each iteration then feels verified, and the write endpoints accumulate changes nobody ever re-ran.
How DevMeth detects it
The scan inventories all app routes, identifies the ones exporting POST, PUT, PATCH, or DELETE handlers, and looks for test evidence: a co-located test file or any test file that references the route's path. Covered routes never fire.
API routes that create, update, or delete your data have no test coverage
WHAT WE FOUND
app/api/orders/route.ts — POST handler — no test mentions /api/orders
The fix, in three steps
Write one happy-path and one failure-path test per flagged route, co-located next to the route file, naming the route's path. Call the route — a test that imports helpers but never calls it does not count.
Run a free scan and each finding carries a paste-ready fix prompt you can act on.
Maintainability findings ship in the Rescue Report — bundled with the Launch Pack or available on its own.
Try a free scanFAQ
Why focus on mutating routes specifically?
GET routes fail loudly and immediately; a broken POST can quietly corrupt, double-write, or drop data with no visible error until it is too late.
What counts as test coverage?
A co-located `.test`/`.spec` file next to the route, or any test file that references the route's path string and calls the handler. Merely testing a helper the route uses is not coverage of the route.
How many tests should I write per route?
Start with two: one success path and one failure path. That is enough to make the re-scan green and catches the vast majority of agent-introduced write-path bugs.
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.