Make your audit test more

Every audit report ends with what it could not test, and why. Most of those gaps close with a few facts only you know: the paths that matter most, how a new user gets past your paywall, what in the code is generated. Set them once and every audit after uses them.

Where to set it

• In the app: your app's settings, then How we audit.
• In your repository: .gate/audit.yaml, synced when you push to your default branch.
• From your coding agent: get_audit_config to read it, set_test_account, suppress_pattern and set_audit_config to change it.

All three change the same settings. A change that makes the audit test less, such as a new suppression, a left-out path or a check taken away, waits for an owner or admin to approve it when it comes from a coding agent or a push.

Test accounts

Stableship signs in as each kind of user on a private copy of your app. When your app sends new users to a paywall, an onboarding page or a terms page first, say what lets them through: the values your code checks on the user (user_metadata, or app_metadata for plan keys) and the page they start on. Never a password or a real account. Role, admin and permission keys are left out: which kind of user an account is comes from your rules. Only owners and admins change these settings; anyone else's change, or their agent's, waits for one of them.

The file

version: 1focus:  - path: supabase/functions/stripe-webhook    reason: moneyignore:  - src/integrations/supabase/types.tstest_accounts:  workspace_member:    user_metadata:      subscription_active: true      onboarding_completed: true    start_path: /campaignssuppress:  - code: review.data_exposure    path: supabase/functions/public-stats/**    reason: These numbers are public on our website    expires: 2026-12-31checks:  - Refunds take back the credits they bought

• focus: paths the code review reads first, each with an optional reason. A folder covers everything in it.
• ignore: paths the review leaves out. Use it for generated or copied code, never to hide a problem.
• test_accounts: per kind of user (the keys from your rules), what to set and where to start.
• suppress: findings that are not problems in your app, by finding code (or a prefix ending in *) and a path pattern, with the reason a teammate will read. Matching findings from the code review and the checks that use your app are kept and listed but never count or block. After expires they count again. A section the file leaves out keeps what is set in the app.
• checks: extra things to check, in plain words.

In paths, * matches within a folder and ** across folders; a folder covers what is in it, and a pattern with no / matches at any depth.

After you change it

The next audit uses it. To test now what the last audit could not reach, re-test from the report; the first re-test within 7 days of an audit is free.