Proof, not testimonials.

The findings, and the ones still open

Before this repositioning, this site carried a 2 MB autoplaying video and a 1.14 MB poster image in the critical path, eight pages each with their own drifted copy of the design tokens, and a bright cyan used as body text on white in about thirty places at roughly 2.1:1. All of that was found by tooling rather than by eye.

The last number is the point. The ten pages that make up the site proper return zero. The six product demo pages behind them return 84 failing elements, most of them the same legacy #00C4D9 cyan used as text on a light background, plus thirteen unlabelled form controls on the ProfitPath demo. They are recorded, severity-rated, and scheduled behind the pages that carry the offer. A site claiming zero defects everywhere would be less credible, not more.

Both figures come from one axe-core 4.13 sweep across every public page at 1280px, run again immediately before this page was published rather than quoted from an earlier run. That matters: an earlier draft of this page cited a number from a page that no longer exists, and re-measuring is what caught it.

Every finding carries its own proof, enforced in code

The engine behind the free site check is built so a finding cannot exist without the nine fields that make it actionable. The record builder throws rather than emit an incomplete finding, and a test asserts that for each field in turn. Severity definitions live in the same module the website publishes, so the page and the code cannot drift apart.

Two integrity rules are enforced rather than intended. A check that could not run is reported as not measured, never as a pass, and never folded into a coverage score. And a target's own robots.txt decides whether we fetch it at all, with a robots.txt we cannot retrieve treated as unknown rather than as permission.

Earlier work applied the same idea to a lead-scoring engine, where a scoring rubric and a written QA plan were maintained alongside the code so any score could be traced to the evidence that produced it.

64 tests, and two bugs found by asking where a number came from

We run an internal trading system. It is the hardest test of QA discipline we have, because a silent defect costs money rather than goodwill, and it produced two findings worth describing.

Two writers for one number. Account equity was being set by two different code paths: a broker heartbeat and the system's own estimate. Because position size, risk caps and the circuit breaker are all percentages of equity, a drifting estimate would mis-size every trade. The fix was a rule rather than a patch: any number that drives sizing has exactly one authoritative source, named in code. It was found by asking where a number came from, which is the same question an audit asks.

A confident score from a failed measurement. A performance check was recording a 79 second timeout as a near-zero speed score for a site that answered in 0.36 seconds. Left alone, that would have told a business their website was slow when it was not. It is the origin of the rule that a timeout is never a zero, now enforced in the audit engine with a test named after it.

Evidence-gated features. A position-sizing multiplier is held at 2x regardless of its configured ceiling until 25 closed trades have actually tested it. A feature the log cannot yet justify does not get trusted.