Quality Assurance

Code-quality, dependency and security gates run before every publish, plus a per-project test gate that is off by default — with one-click AI fixes.

From code to confidence

Before your app goes live, Airbuild runs a layered set of automatic checks — tests, code quality, dependencies and security — so broken or risky code is caught before it reaches your users. Every check is visible in the Tests tab in the exact order it executes, each with a per-check checklist and a clear pass/fail state. The tab comes with the testing integration, so it appears once that is enabled.

The test cockpit

The Tests tab is a full cockpit:

• Run tests on demand, or let the AI agent write and run them for you
• Per-test results with filters, grouped by file
• Line-level code coverage
• Run history and exportable results
• Live progress shown as a card in the chat

Pre-publish quality & security gates

When you publish — and on demand from the chat — Airbuild runs open-source tools inside its own EU pipeline, against a frozen snapshot of exactly the code that ships.

On by default for every project, high-severity findings block the publish:

• Static security (SAST) — Semgrep: finds insecure patterns in the generated code
• Dependencies & secrets — Trivy: scans for known vulnerabilities (CVEs) and leaked secrets
• Code quality — Ruff (Python) and Biome (TypeScript/React): error handling, async pitfalls, performance traps and a security ruleset

Always on for backend apps: every endpoint reachable without authentication is listed and must be confirmed before the publish proceeds. If the OpenAPI specification cannot be generated at all, this check passes instead of blocking.

Switchable on per project:

• Deep quality — SonarQube Cloud: whole-project analysis for bugs, code smells and maintainability
• API contract — Spectral: lints the generated OpenAPI specification (advisory)
• Dynamic security (DAST) — OWASP ZAP: probes a throwaway copy of the running app (advisory)

These tools analyse your generated code, not personal data. All of them run inside Airbuild's own EU pipeline except one: the Deep quality gate sends the analysed code to SonarQube Cloud (SonarSource SA), which processes it in the EU (AWS Frankfurt); each scan runs in a throwaway analysis project that we delete once the scan finishes, and where a deletion does not complete, retention follows SonarSource's terms. SonarSource is named on our sub-processors page.

What a passing publish means

A gate acts on what a check reports, not on whether the check managed to report. If one cannot run at all — a scanner fails to start, the OpenAPI specification cannot be generated — the publish proceeds rather than being refused. So a publish that goes through means nothing blocking was reported, not that every check completed. The Publish checks panel lists the tools that actually ran.

Fix findings with AI

Every finding lands in one unified Problems panel, grouped by the type of check. Hand the whole list to Fix with AI and the agent resolves them in a single pass — then re-run the gate and publish.

Test gate before publish (per project, off by default)

The generated test suite is a per-project switch and it starts out off: tests run and report in the Tests tab, but a red suite does not stop a release. Turn the gate on in Settings and a failing suite blocks the publish from then on. The Publish checks panel afterwards shows which tests and gates ran and what they returned.

Open-endpoint check

Before going live, Airbuild also flags publicly reachable, unauthenticated API endpoints and lets you select which ones to secure and hand straight to Fix with AI.