B. Quality, Speed & Resilience · Prompt 22
Test Coverage & Quality
Get the free PDFWhy it matters
A test suite that does not check the real outcome can create false confidence.
Modeled on
Coverage tools such as Istanbul, and mutation testing such as Stryker.
How to run this prompt
- Switch to a mode that does not edit files. In Cursor that is Ask or Plan. In Claude Code that is Plan mode.
- Paste the audit prompt. Wait for the report. It must stop and ask which IDs to fix.
- Read the report. Keep the IDs you agree with.
- Switch to a mode that can edit. Paste the fix prompt and the IDs you chose.
- Switch back to the read-only mode and paste the same audit prompt again. Confirm those IDs are gone.
- Cursor: audit in Ask mode or Plan mode. Fix in Agent mode.
- Claude Code: audit in Plan mode (Shift+Tab cycles to it). Fix in Normal mode, which can edit.
- Any other tool: audit in Chat, Discuss, or Plan mode, whichever answers without editing files. If the tool has no such mode, the prompt itself forbids edits. Fix in the mode that is allowed to edit files.
The audit prompt
MODE: AUDIT ONLY. Do not create, edit, or delete any file. Do not run commands
that change anything: no installs, migrations, git commits, deploys, or "--fix" flags.
If your tool has an Ask, Plan, Chat, or Discuss mode, use it for this prompt.
Before you start:
- Tell me the stack you detect (framework, language, database, auth, hosting,
payment provider) and which folders you will review.
- If a check below does not apply to this stack, write "Not applicable" and why.
- If you can run read-only commands, run the ones listed. If you cannot, list them
so I can run them and paste the output.
Test Coverage & Quality: what to check
Review tests for usefulness, not only for whether files exist. You may run the test command if it is read-only and does not touch production. Do not add tests in this pass.
1. Say whether payments, auth, and data changes have any tests. Name the files or say none.
2. Flag tests that only check "it did not throw" or that a result is the right type, without checking the value.
3. Flag missing cases you can see from the code: empty input, null, a failed network call, or two writes that must not double-apply. Do not invent cases that the function cannot reach.
4. Flag tests that assert private function details or snapshot large markup that will break on a harmless edit.
5. Flag tests that are skipped, commented out, or marked TODO.
6. Say whether reading the tests would teach a new person how the feature should behave.
7. Name the 5 missing tests most likely to catch a real bug, in order, with the input and the expected result.
8. If there is no test runner, say so in the first line and still list the 5 tests you would write first.
Evidence rules:
- Every finding cites a file path and line number, or the exact command output used.
- Mark each finding Confirmed (seen in the code) or Needs manual check (depends on
something outside the repo, such as a dashboard setting or production data).
- Never print a full secret. Show the first 4 characters and the location only.
- If you are not sure, say so. Do not invent files, settings, or results.
Severity: Critical = exploitable now, or leaks real data or money. High = serious
with little effort. Medium = weakens defenses or needs a second bug. Low = hygiene.
Report:
- Summary: count of findings by severity.
- Table: ID | Severity | Confirmed? | Finding | Evidence | Why it matters | Suggested fix | Effort
(IDs for this prompt use the prefix P22, for example P22-1, P22-2.)
- Checked and fine: what you verified is already OK.
- Could not check: what I need to look at myself, and where.
Then stop. Do not fix anything. Ask me which IDs I want fixed.