Every check the console runs, written down.

Pasted source is parsed, then read for the defects generated code repeats most: credentials in source, execution sinks, swallowed errors, placeholder links and broken markup.

• Hard-coded credential

  Security

  An API key, token, password or connection string assigned in source rather than read from configuration.

  Critical

• Private key block

  Security

  A PEM-encoded private key pasted into a file that would be committed.

  Critical

• Cloud access key

  Security

  A long-lived access key id and secret pair from a cloud provider, in source or in an example.

  Critical

• Model provider secret

  Security

  A provider-issued secret key used directly from browser code, where anyone can read it.

  Critical

• JSON Web Token in source

  Security

  A signed token committed as a literal, which stays valid until it expires wherever it was pasted.

  Critical

• eval and the Function constructor

  Security

  A string compiled into executable code at runtime, reachable from whatever fills that string.

  High

• SQL built by concatenation

  Security

  Query text assembled from input rather than bound as parameters, which is injection by construction.

  High

• Shell execution reachable

  Security

  A process, command or exec call whose argument can carry request data.

  High

• HTML written without escaping

  Security

  Markup assigned to a sink that parses it, so an input value becomes script.

  High

• A failure is swallowed silently

  Correctness

  An empty catch block, a default returned instead of an error, or a rejection nobody handles.

  High

• Source does not parse

  Correctness

  Unbalanced brackets or a truncated block: the file will not run, whatever else it does.

  High

• document.write reparses the page

  Quality

  A call that rewrites the document after load, discarding anything already rendered.

  Medium

• Placeholder links

  Quality

  A bare hash, an empty href or an example domain left in a template and shipped as a dead link.

  Medium

• Unfinished markers

  Quality

  TODO, FIXME and lorem ipsum blocks in code that is presented as complete.

  Medium

• Debug logging left in

  Quality

  Console output and debugger statements left running in a build, often printing values you would not log.

  Medium

• Plain-HTTP resource

  Security

  A script, style or image loaded over an unencrypted connection from a page served over TLS.

  Medium

• Click handler on a non-interactive element

  Accessibility

  A div acting as a button, which cannot receive keyboard focus or be operated without a pointer.

  Medium

• Missing viewport declaration

  Accessibility

  No viewport meta tag, so a phone renders the page at desktop width and scales it down.

  Medium

• Missing lang attribute

  Accessibility

  A root html element with no language, which changes how a screen reader pronounces the page.

  Medium

• Long lines and duplication

  Quality

  Lines past 260 characters and repeated blocks, measured rather than judged.

  Low

Pasted prose is measured for rhythm, repetition and the residue that marks a draft as unfinished: placeholders, disclaimers, hedged claims and paragraphs with no evidence behind them.

• Model disclaimer left in

  Correctness

  A line explaining that the text was generated, still attached to copy about to be published.

  Critical

• Placeholders in published copy

  Correctness

  [insert company], lorem ipsum, bracketed instructions and example values left in a live draft.

  Critical

• Average sentence past 27 words

  Readability

  Sustained length that a reader has to work through, measured across the whole piece.

  High

• Sentence lengths barely vary

  Readability

  Uniform rhythm, the single strongest signal that text was generated rather than written.

  Medium

• Sentences open the same way

  Readability

  Repeated openers and transitions that make every paragraph start with the same gesture.

  Medium

• Phrases repeat themselves

  Quality

  The same phrase returning within a short span, usually a tell that survives a synonym swap.

  Medium

• Em dashes crowd the punctuation

  Quality

  Density of dashes replacing commas and full stops, which reads as cadence without structure.

  Medium

• The copy hedges its own claims

  Claims

  Qualifiers stacked until a sentence asserts nothing a reader could hold you to.

  Medium

• Long piece with no headings

  Structure

  Several hundred words with nothing to scan by, which is where readers leave.

  Medium

• Adverb density

  Quality

  Intensifiers propping up weak verbs, counted rather than rewritten.

  Low

• Lexical variety

  Quality

  How much distinct vocabulary a piece actually uses behind its word count.

  Low

• Too short to judge

  Coverage

  Stated plainly rather than scored: a hundred words cannot support a verdict.

  Low

Markdown, HTML, JSON and structured text are read for the failures that survive review because they render fine: skipped heading ranks, duplicate sections, unparsed data and inconsistent dates.

• JSON does not parse

  Correctness

  A trailing comma, an unquoted key or a truncated object: anything downstream fails on this.

  Critical

• No headings anywhere

  Structure

  A document navigable only by reading it end to end, with no outline to export or link into.

  High

• No level-one heading

  Structure

  Content with no declared title, which breaks tables of contents and most exports.

  High

• Heading levels skip a rank

  Accessibility

  A jump from level two to level four, which is a broken outline to assistive technology.

  Medium

• Duplicate section headings

  Structure

  Two sections sharing a title, so inbound anchors and jump links resolve unpredictably.

  Medium

• A block runs past 220 words

  Readability

  A wall of text with no break, measured per block rather than per document.

  Medium

• Two date formats in one document

  Correctness

  Ambiguous dates side by side, where one reader sees a month and another sees a day.

  Medium

• JSON parses but carries no keys

  Correctness

  An empty object or array that is valid and useless, usually a truncated export.

  Medium

• Link and anchor problems

  Quality

  Placeholder links and anchors with no matching heading, counted per document.

  Medium

Image files are decoded and inspected in the browser: provenance metadata, dimensions, compression and the visual signals that survive a pass through a screenshot.

• No provenance metadata

  Provenance

  No C2PA manifest, Content Credentials or XMP block, so the file carries no statement about its origin.

  Medium

• C2PA manifest present

  Provenance

  A content credentials manifest was found; the report names the claim generator when it is recorded.

  Low

• Cannot be decoded

  Correctness

  The browser could not read the file, which means a reader will not see it either.

  Critical

• Effectively a blank canvas

  Quality

  Almost no variance across the image, the shape of a failed generation rather than a design.

  Critical

• Flat, low-contrast

  Quality

  Contrast too low for text laid over it, measured from the decoded pixels.

  Medium

• Almost entirely desaturated

  Quality

  A grey wash where colour was expected, common in over-processed exports.

  Medium

• Compressed past comfort

  Quality

  Bytes per pixel far below what the dimensions imply, with the artefacts that follow.

  Medium

• Soft focus or heavy compression

  Quality

  Edge detail lost to resizing or re-encoding, visible once the image is placed at size.

  Medium

• Composition and likeness

  Coverage

  Whether a human needs to judge people, text or brand marks is reported as coverage, not scored.

  Low