Search Request an audit quote

Test with AI

QA for AI-generated code: review, tests and a regression safety net

Your developers ship faster with AI coding assistants, and review and tests have not sped up to match. You get an audit of one module that shows what its current tests would miss, then the missing tests and a regression check in CI that stops a breaking change at the pull request.

Request an audit quote How an engagement runs
audit findings, AI-assisted pull requests, billing module 1 passed 2 failed 1 review
  • Invoice rounding in a new helper Behaviour matches the existing billing rules defect
  • Generated unit tests for the helper Tests fail if the logic is broken weak
  • New endpoint for refunds Authorisation checked for every role engineer
  • Refactor of the date module Existing behaviour unchanged on the regression set stable
  • Founders of CodeceptJS and Codeception
  • Founders of Testomat.io and Testomat.ai
  • Since 2015
  • 4.9 out of 5 on Clutch
What it is
QA and testing of AI-generated code
First step
AI-written code audit About one week
You receive
Defects and risks found, each with the file and the line +2 more
After that
Pilot Two to six weeks

What we test

Services in this area

  • Review of AI-written code

    Engineers read what the assistant produced against what was asked for, and report what does not match.

    • Logic checked against the requirement, not only against the compiler
    • Invented or misused library calls, and dependencies nobody chose
    • Error handling, input validation and permission checks read by hand

  • Tests that can fail

    Generated tests often confirm what the code does instead of what it should do. Existing tests are checked by breaking the code on purpose; missing ones are written from the requirement.

    • Deliberate faults put into the code to see which tests notice
    • Unit, API and integration tests for the risky paths first
    • Tests written from the requirement, not read off the code under test

  • Automated regression testing in CI

    A safety net that runs on every change, so a fast assistant cannot quietly break what worked yesterday.

    • Characterisation tests that pin down current behaviour before a refactor
    • Checks on every pull request that your team can read and extend
    • A failing check blocks the merge until someone decides what is right

  • Review rules for AI-assisted pull requests

    Short, written rules for what the author and the reviewer do when the code came from an assistant.

    • What a pull request says about how the code was produced
    • What the author runs and reads before asking for review
    • What the reviewer verifies that a green build does not show
Checks on a pull request with AI-written codeA pull request with code from an AI coding assistant goes through four checks. Review, the gate: an engineer checks the requirement match, existing behaviour, dependencies and boundaries. Tests that can fail: tests proven useful by deliberate faults, a technique known as mutation testing. Regression check in CI: a regression set shows whether the change altered something that worked. Merge: only after the checks pass. A failed check stops the change at the pull request and sends it back.AI assistantPull requestCode from an AIcoding assistantEngineerReviewRequirementmatch,dependencies,boundariesCITests thatcan failProven bydeliberate faults(mutationtesting)CIRegressioncheckShows whethersomething thatworked haschangedYour teamMergeOnly after thechecks passA failed check stops a breaking change at the pull requestChecks on a pull request with AI-written codeA pull request with code from an AI coding assistant goes through four checks. Review, the gate: an engineer checks the requirement match, existing behaviour, dependencies and boundaries. Tests that can fail: tests proven useful by deliberate faults, a technique known as mutation testing. Regression check in CI: a regression set shows whether the change altered something that worked. Merge: only after the checks pass. A failed check stops the change at the pull request and sends it back.AI assistantPull requestCode from an AI coding assistantEngineerReviewRequirement match, dependencies, boundariesCITests that can failProven by deliberate faults (mutationtesting)CIRegression checkShows whether something that worked haschangedYour teamMergeOnly after the checks passA failed check stops a breaking change at thepull request
How a pull request with AI-written code passes review, tests that can fail and a regression check in CI, which stops a breaking change before it is merged.

What changes when an assistant writes the code

Review and testing were designed for code that a person wrote slowly and understood. Code from an assistant differs in ways that matter to QA.

  • It reads well and can still be wrong. Names are tidy and comments are confident. A subtle logic error or a misread requirement does not show up on a quick read.
  • Nobody holds the whole picture. The developer prompted it and skimmed it. When it breaks, no one remembers why it was written that way.
  • Its tests share its blind spots. If the same assistant wrote the code and the tests, the tests often confirm what the code does instead of what it should do.
  • Volume goes up. More changes per week means more to review, and review time does not grow with it.

The answer is not slower development. It is checks that run on every change and a second pair of eyes on the code that carries risk.

How the audit tests the tests

A test suite can be green and still protect nothing. The audit finds out by changing the code on purpose, a technique known as mutation testing, and watching which tests fail.

Deliberate fault A useful test A weak test
Rounding changed from half-up to down Fails on the invoice total Passes, because it only checks that a number is returned
Permission check removed from an endpoint Fails for the user without the role Passes, because it only calls the endpoint as an admin
Off-by-one in a date range Fails on the last day of the month Passes, because its sample dates are mid-month

Every fault that no test catches becomes a line in the map of untested behaviour.

What the review covers

Area Example checks
Requirement match The code does what was asked, including the cases the prompt did not mention
Existing behaviour A change did not alter something that worked, shown on a regression set
Dependencies Libraries and functions exist, are used as documented and were chosen on purpose
Boundaries Input validation, error handling, permissions and data handling
Consistency The new code follows the structure and conventions of the code base

For end-to-end coverage of the product built from this code, see end-to-end testing with AI agents; for a review of your whole test process, see QA audit and assessment.

How an engagement runs

Start small, with a fixed scope

Each step has a defined scope, duration and deliverables. You decide after each one whether to continue.

  1. Step 1 About one week

    AI-written code audit

    One service or module written largely with AI assistants. We read the code, run it, and measure what the existing tests would catch by putting deliberate faults into it.

    You get

    • Defects and risks found, each with the file and the line
    • Map of the behaviour that has no test that would fail
    • The tests and CI checks to add first
  2. Step 2 Two to six weeks

    Pilot

    The highest-risk paths of that module get tests and a regression check in your CI, and your team starts using the review rules on real pull requests.

    You get

    • Tests and CI checks merged in your repository
    • Review rules for AI-assisted pull requests, ready for your contributing guide
    • Handover session with your developers
  3. Step 3 Monthly

    Ongoing

    Zapple.Tech engineers review the riskiest AI-assisted changes and extend the tests as the code base grows, working in your pull requests.

    You get

    • Review of flagged changes before release
    • Tests kept in step with the code
    • Monthly report on what the checks stopped

FAQ

Questions buyers ask

Is AI-generated code worse than code written by people?

We do not claim that. The risk is different: it arrives faster and reads well, so it is easy to merge without enough checking. The audit measures your code, not a general rule.

Our developers already review pull requests. What does this add?

A reviewer reads a diff. The audit also runs the code, breaks it on purpose to see whether the tests notice, and checks the behaviour against the requirement rather than against the code beside it. It is done by someone who did not prompt the assistant.

Can you tell which code was written by AI?

Not reliably, and it matters less than it seems. The module to audit is chosen with you, from your commit history, your team's knowledge and where the business risk sits.

What access do you need?

Read access to the code under audit and to your CI configuration, and a developer who can answer questions about the requirements. For the pilot, the work goes through pull requests in your repository.

Do you put our code into an AI tool?

Only tools you approve. If your rules say code must not leave your environment, the audit is done without any external AI service.

Who does the work?

Zapple.Tech test automation engineers, who write the unit, API and integration tests themselves. The company's founders are the founders of CodeceptJS and Codeception, two open-source testing frameworks.

How long does it take?

The audit takes about a week for one module. The pilot runs two to six weeks, depending on how many risky paths the audit found and how testable the code is today.

How much does it cost?

Prices are not published. The quote depends on the size of the module, the language and how much test infrastructure already exists. Describe the code base and your team and you get a scoped quote within one business day.

Start with a one-week audit of AI-written code

Tell us which module or service your team writes mostly with AI assistants, and in which language. We reply within one business day with scope, timeline and a quote.

  • Founded by the founders of CodeceptJS and Codeception, open-source testing frameworks
  • Founded by the founders of Testomat.io and Testomat.ai
  • On the market since 2015
  • Rated 4.9 out of 5 on Clutch, from 7 client reviews

Prefer to talk first? Schedule a call

    We reply within one business day.