# Audit your routes

A test that fails when a route can be reached without a credential, hidden routes included:

```python
from fastapi_multiauth import auth_surface

from .sessions_and_tokens import app

PUBLIC = {"/login"}


def test_no_unguarded_routes():
    unguarded = [
        f"{','.join(route.methods) or 'WS'} {route.path}"
        for route in auth_surface(app)
        if route.unguarded and route.path not in PUBLIC
    ]
    assert not unguarded, unguarded
```

When someone adds a route and forgets to protect it, CI fails until the route gets a guard or is added to `PUBLIC` on purpose. See [Auditing](<https://fastapi-multiauth.d3vyce.fr/guide/auditing/index.md>) for what `auth_surface` reports.