Findings gallery

What the reports actually catch.

9 worked findings in the language the report uses. Each names the pattern, why it survives review and the change that closes it. They are representative examples of reported defects, not client disclosures.

A number, a tolerance, a decision.

CodeCriticalSecurity

A model API key assigned in the component that calls it

A client-side handler built from a prompt, with the provider key assigned to a constant at the top of the file so the request would work locally.

Why it matters

Any key shipped to a browser is public the moment the page loads. The bill arrives before the leak is noticed, and rotating it does not undo what was already spent.

What changes

Move the call behind a server function that reads the key from environment configuration, and treat the shipped key as compromised rather than deleted.

How this check works

CodeHighSecurity

Search endpoint that builds its query from the request

A working search route where the term is interpolated into the SQL string, which reads naturally and returns correct results for every normal query.

Why it matters

Correct on good input is exactly what makes injection durable. The defect only shows on input nobody typed during testing.

What changes

Bind the term as a parameter. This is a one-line change that no functional test will ask for.

How this check works

CodeHighCorrectness

An error path that returns the empty list

A data loader with a try/catch wrapping the whole function and a return of empty results in the catch block, so a failed request is indistinguishable from no records.

Why it matters

The page renders, the user sees zero rows, and nothing reaches a log. The failure can persist for weeks before somebody notices the totals are wrong.

What changes

Let the error surface to the caller, render an error state, and log it with an identifier support can search.

How this check works

ContentCriticalCorrectness

A generated landing page intro that still explains itself

Two confident paragraphs of product copy followed by a sentence noting that this was drafted with an AI assistant and should be reviewed.

Why it matters

The disclaimer is the least bad part. A draft that still carries it was never read end to end, which means the claims above it were never checked either.

What changes

Remove the disclaimer and check every claim before it goes near a publish button. The presence of the note is a signal to restart the pass, not delete one line.

How this check works

ContentMediumClaims

A performance claim qualified until it says nothing

A sentence asserting that teams may potentially see meaningful improvements in some workflows, placed directly under a headline promising a specific percentage.

Why it matters

The body hedges while the headline commits. Readers keep the headline, and the qualifier is what the author reaches for when challenged.

What changes

Either source the number and state it once, plainly, or drop it. A qualified claim under a bold headline is worse than no claim.

How this check works

DocumentHighStructure

A handover brief with no level-one heading

A generated project brief that opens straight into a level-two heading, repeats a section title for two different steps and skips a rank halfway through.

Why it matters

It reads fine on screen and exports badly: the table of contents is empty, the anchors collide, and the outline a screen reader navigates by is broken.

What changes

One level-one heading, ranks that increase by one, and a unique title per section. Re-check anchors after any heading edit.

How this check works

DocumentCriticalCorrectness

A config export that parses as an empty object

Valid JSON of two characters, produced by a generation that stopped early. Every linter downstream accepted it.

Why it matters

Valid syntax reads as healthy. Nothing in the pipeline errors, and the configuration silently applies nothing.

What changes

Treat an empty object as a failure wherever configuration is consumed, and assert the required keys rather than assuming the file is populated.

How this check works

ImageMediumProvenance

A hero image with no statement about where it came from

A decoded image with dimensions and compression intact and no C2PA manifest, no Content Credentials and no XMP block recording a generator.

Why it matters

Provenance is the only part of an image that a reader cannot verify by looking. Once it is stripped, no later reviewer can reconstruct it.

What changes

Record the source at the point of use and keep the original file. Stripping is what makes a provenance question unanswerable later.

How this check works

ImageCriticalQuality

A generated visual that is almost entirely one tone

A file that opens as a wash of near-identical pixels, technically an image and unusable as a hero. Variance was close to nil across the frame.

Why it matters

Nobody reopens an asset that was approved by filename. It reaches production and reads as a broken layout rather than a bad image.

What changes

Check the decoded image rather than the thumbnail, and reject assets with no visual variance before they enter the library.

How this check works

Reference

The full list of checks behind these findings, with severities.

Check reference →

Sample report

See how findings, metrics and the score are assembled on one page.

Open a report →

Human layer

Where a finding needs judgement, a named reviewer takes it from the report.

Meet the reviewers →

Your own file

Most findings are boring and repeatable. Find yours.

Paste code, copy, a document or an image and the console returns the same categories you just read, scored against your work.

Run a check Request a specialist