Features
A surgical autonomous architecture ensuring 0% hallucinations and 100% hard evidence in 15 to 30 seconds: real Chromium execution, AST static analysis, non-destructive DAST, and automated .patch generation.
The 3 Universal Scoring Pillars
1. Functionality, Journeys & Accounts
Does the tool actually work across pages, forms, sign-up, login, and mobile?
2. Security, Access & Data Protection
Are users, sessions, APIs, secrets, and dependencies safely protected?
3. Performance, Experience & Quality
Is the application fast, accessible to everyone, well-indexed, and cleanly built?
10 Specialized & Complementary Audit Modules
Security & Protection
Vulnerabilities, authentication, permissions, secrets, insecure configurations, and data protection risks.
Inspects HTTP security headers (CSP, HSTS, X-Frame-Options), TLS enforcement, cookie flags, CORS exposure, form security, hardcoded secrets, and live OSV.dev dependency advisories when manifests are connected.
Functionality & Bugs
Buttons, forms, registration, login, navigation, user journeys, business workflows, and test payments.
Launches an isolated Playwright browser to navigate pages, validate internal links, monitor uncaught JavaScript exceptions, console errors, failed 4xx/5xx network calls, forms, and authorized test account login flows.
Performance & Speed
Page load, response times, resource usage, bottlenecks, and supported load tests.
Measures real TTFB, First Contentful Paint (FCP), DOMContentLoaded, Load Event duration, transfer weight, uncompressed payloads, and render-blocking assets using browser Navigation & Resource Timing APIs.
Mobile & Compatibility
Responsive behavior, mobile navigation, touch interactions, browser compatibility, and layout defects.
Renders the target across 390×844 smartphone, 768×1024 tablet, and 1440×900 desktop viewports to detect horizontal overflow, missing viewport configuration, undersized touch targets, and clipped elements.
Design & User Experience
Usability, navigation clarity, visual consistency, readability, and interface quality.
Evaluates landmark clarity, interactive affordances, unlabeled inputs/buttons, typography hierarchy, contrast ratios, and empty or broken visual media.
Code & Architecture
Code quality, logic errors, dependencies, architecture, maintainability, and technical risks.
Performs static source inspection on connected GitHub repositories or uploaded ZIP archives (dangerous eval/HTML sinks, SQL string concatenation, oversized modules, dependency pinning). Explicitly skipped when only a public URL is connected.
API & Data
API contracts, response validation, authorization, data integrity, and integrations.
Parses OpenAPI/Swagger specifications or discovered endpoints, executes safe non-destructive GET/HEAD contract checks, verifies status codes, content types, auth enforcement, and stack-trace leakage.
Accessibility & SEO
Accessibility standards, semantic structure, metadata, and technical SEO.
Runs @axe-core/playwright WCAG 2.1 Level A/AA rules alongside document lang, title, meta description, canonical URL, OpenGraph tags, robots directives, and heading structure checks.
Reliability & Infrastructure
Deployment configuration, dependency risks, error handling, resilience, and operational reliability.
Checks response compression (Brotli/Gzip), cache policies, server banner disclosure, graceful 404 handling, security.txt presence, and Dockerfile/CI configuration hygiene when source is available.
13-Agent Autonomous Orchestration Pipeline
Every audit coordinates 13 specialized agents that cross-verify HTTP, DOM, source code, and screenshot evidence before confirming any finding (F1 = 1.00).
Project Discovery & Sitemap Agent
HTTP/DOM stack fingerprinting, robots.txt, sitemap.xml, security.txt parsing, and ZIP/Git file tree inspection.
Cyber-Defense & Security Agent
CSP quality, HSTS, XFO, XCTO, CORS, cookies, /.env & /.git/HEAD probes, JS bundle secrets, .js.map SourceMaps, and live OSV.dev CVEs.
Static Code Analysis Agent (SAST)
Multi-line SQL injection detection, eval/innerHTML sinks, weak cryptography (MD5/SHA1/Math.random), and silent catch blocks.
Functional Journeys & Auth Agent
Autonomous multi-step signup (2–6 step wizards), auto-login, authenticated inner folder crawl, dead-button probing, and UI text integrity (NaN €).
Performance & Web Vitals Agent
Real Chromium Navigation & Resource Timing (TTFB, FCP, DOMContentLoaded, Load Event, and transfer byte weight).
Mobile Compatibility Agent (390×844)
Dedicated smartphone viewport rendering, horizontal overflow detection, viewport meta verification, and 44×44 px tap target sizing.
UX, WCAG Accessibility & SEO Agent
@axe-core/playwright WCAG 2.1 Level A/AA verification, semantic heading hierarchy, form labels, and technical SEO metadata.
API, Network Contract & AuthZ Replay Agent
OpenAPI validation, live JSON traffic inspection, sensitive field leak detection, and unauthenticated replay of private API routes.
Infrastructure & Operational Hygiene Agent
Server banner disclosure checks, Cache-Control policies, and Dockerfile non-root user & pinned-tag verification.
Regression Diffing Agent
Deterministic SHA-256 fingerprint comparison against baseline audits (New, Resolved, Persistent findings, and Score Delta).
Independent Verification Agent
Deduplication and second-pass HTTP/DOM verification separating CONFIRMED vs. SUSPECTED findings with confidence scores.
Universal Fix & .patch Agent
Generates ready-to-apply unified .patch diffs for 100% of findings and prepares 1-click AI Fix Prompts for Cursor / Claude.
Executive Dossier & Trilingual Export Agent
Compiles the 14+ executed checks matrix and exports Executive PDF, JSON, SARIF 2.1.0, ZIP, and .patch bundles in EN, FR, and DE.