# Testing and security

What the tests really prove, and where input from outside can reach something sensitive.

- [Unit tests that give false comfort](https://atlasscope.dev/prompts/unit-tests-that-give-false-comfort): Finds features whose automated checks all pass and that still break for real people.
- [Tests that can't fail](https://atlasscope.dev/prompts/tests-that-cant-fail): Finds tests that pass no matter what.
- [Outside input reaching sensitive actions](https://atlasscope.dev/prompts/outside-input-reaching-sensitive-actions): Follows input from outsiders to the places it can do harm.
- [Risk from outside packages](https://atlasscope.dev/prompts/risk-from-outside-packages): Checks what a harmful outside package or pull request could reach.
- [Security checks that fail open](https://atlasscope.dev/prompts/security-checks-that-fail-open): Finds security checks that let people in when something goes wrong.
- [What the tests really prove](https://atlasscope.dev/prompts/what-the-tests-really-prove): Asks what each test really proves, then adds one check that would catch a real break.
- [Settings that differ in production](https://atlasscope.dev/prompts/settings-that-differ-in-production): Finds settings that behave differently in production than anyone expects.

Source: https://atlasscope.dev/prompts/testing-and-security