The mistakes AI-written code repeats, caught at the line.
Truemend checks code against 4,672 patterns across 26 languages. Each pattern names one specific mistake. A finding says where it is, how serious it is, and how it can be changed.
From the first audit
The story →- Functions that ran far too long and did several jobs at once
- Error handling copied from one place to the next
- Types set to any so the code would compile
- Components with more useState calls than anyone could follow
- Debug leftovers and dead code after the feature shipped
Six parts, one card.
Every finding has the same shape, in the terminal, in the pull request and in the report.
The catch block is empty, so a failed query is dropped and never reaches the logger.
- 1PatternThe specific mistake, with a stable name you can search, suppress or discuss.
- 2SeverityHow much it can hurt: critical, high, medium, low or info.
- 3LocationThe file and line, so nobody has to hunt for it.
- 4Why it mattersOne sentence in plain language on what goes wrong.
- 5TierWho acts: applied for you, a bounded refactor you review, or your call.
- 6The changeThe diff on offer. Nothing on disk changes until you apply it.
Illustrative finding. The pattern, severity and fix are the library’s own.
Three tiers, in plain terms.
Every pattern is filed into a tier before you ever see a finding, so you know in advance what will be offered as a change and what will be left to you.
Applied for you
The change is mechanical and checked by re-parsing the file. You get a diff to review, and nothing merges without you.
e.g. empty-catch-block37.1% of the libraryBounded refactor
A defined change to one function or pattern. It is opt-in, comes as a reviewed diff, and has a cost attached.
e.g. function-too-long57.7% of the libraryYour call
An architectural decision. You get evidence and options with a cost. It is never applied automatically.
e.g. god-function5.0% of the library
Shares are of patterns in the library, not of the findings on any one codebase.
Seven stages, from the rules your lead sets to the reviewer who signs off.
Illustrative sample run. Validation checks do not prove a change preserves every behavior; review diffs and run your tests before merging.
Sixteen you will see early.
All 4,672 patterns, by language →Error handling
empty-catch-blockMediumApplied for youAn empty catch drops the error silently.try-catch-rethrowMediumApplied for youA catch that only rethrows adds nothing.python-bare-exceptMediumBounded refactorA bare except also catches Ctrl+C and shutdown.python-try-except-passInfoBounded refactorAn except that only passes hides every error.
Types
any-type-usageMediumBounded refactorAn explicit any switches off the type checker.ts-any-castMediumBounded refactorCasting to any hides a real type mismatch.
Size and complexity
function-too-longMediumBounded refactorOne function doing several jobs.cross-long-param-listMediumBounded refactorToo many parameters to call it correctly.god-functionHighYour callSo many code paths it needs decomposing.
React state
excessive-usestateHighBounded refactorMore than five useState hooks in one component.derived-state-useeffectHighBounded refactoruseEffect used to sync a value useMemo could derive.ts-useeffect-missing-cleanupMediumBounded refactorA listener added in useEffect is never removed.
Leftovers
debugger-statementHighApplied for youA debugger statement shipped to production.ts-unreachable-codeMediumApplied for youStatements after a return that never run.unused-importsLowApplied for youImports nothing in the file uses.
Unvalidated input
security-unvalidated-inputHighBounded refactorRequest input used without a schema check.
HighMediumLow or infoFrom the 2026.08.03 definitions snapshot.
See what it finds on your own code.
Run it locally. Nothing on disk changes until you apply a fix.
$ pip install truemend$ truemend .