Test coverage

What is test coverage?

Test coverage is a measurement of how much of a codebase is executed when its automated test suite runs, usually reported as a percentage. The most common metric is line (or statement) coverage; stricter variants count branches taken (branch coverage) or functions called. The number is produced by instrumenting the code, running the tests, and recording what actually executed. Its meaning is asymmetric: low coverage proves that code is untested, but high coverage does not prove the code is correct, because coverage counts execution, not verification. A test can run a line without asserting anything about its result.

How it shows up in practice

Coverage arrives via tools like Istanbul or Vitest for JavaScript, coverage.py for Python, JaCoCo for Java, and go test -cover, often enforced as a CI threshold:

Statements: 71.4% | Branches: 58.2% | Functions: 80.1%

Two failure modes dominate. Uncovered error paths: the happy path is tested, but the catch blocks, validation failures, and timeout handling (the code that runs during incidents) never execute in tests. And coverage theater: when a percentage becomes a gate, teams produce assertion-free tests that inflate the number without checking behavior, which is arguably worse than honest gaps because it manufactures false confidence.

Why it matters in a code audit

Auditors read coverage as a map, not a grade. The interesting question is never “is it 80%?” but “what exactly is in the uncovered 20%, and how often does it change?”. Zero coverage on payment logic is a finding; zero coverage on a legacy report nobody runs is a footnote. An audit also samples test quality directly: do the tests assert meaningful outcomes, do they cover branches or just lines, and would they fail if the logic were broken? Coverage matters doubly for remediation, because untested code cannot be refactored safely, which is how technical debt becomes permanent. Complex functions with high cyclomatic complexity and low branch coverage are the highest-risk squares on the map. The auditor’s checklist is expanded in test coverage: what auditors look for.

A free code audit shows you where your real coverage gaps are, not just your percentage.