Security
Session cookie set without Secure or HttpOnly flags
NIST SP 800-53 SC-8 alignment · /account/login · Set-Cookie response header
Session tokens are exposed to interception and to script access. Set Secure, HttpOnly, and SameSite attributes on all session cookies.
Strict-Transport-Security header absent on two subdomains
OWASP ASVS 9.1 · shop.example · careers.example
Browsers may negotiate insecure connections on first visit. Serve HSTS on every host, not just the apex domain.
Content-Security-Policy permits wildcard script sources
OWASP ASVS 14.4 · sitewide · CSP response header
Wildcard sources allow any script from any matching host to execute. Enumerate the exact origins the site actually uses.
Accessibility
Checkout form fields lack programmatic labels
WCAG 2.2 SC 1.3.1, 3.3.2 · /checkout · 11 input elements
Screen-reader users cannot complete a purchase. Associate every visible label with its form control.
Primary purchase button contrast measures 2.8:1
WCAG 2.2 SC 1.4.3 · sitewide · .btn-buy
Text contrast falls below the 4.5:1 minimum. Darken the button text or background until the ratio passes.
Mega-menu traps keyboard focus
WCAG 2.2 SC 2.1.2 · global navigation · nav[aria-label="Products"]
Keyboard users cannot exit the menu without a pointing device. Provide an Escape path and correct the tab sequence.
Product imagery missing text alternatives
WCAG 2.2 SC 1.1.1 · /products · 214 img elements
Products are invisible to assistive technology. Add alt text that describes the product, not the filename.
Privacy
14 tracking scripts execute before the consent choice
State consumer privacy statutes · sitewide · tag manager container
Data collection begins before the visitor answers the consent banner. Gate non-essential tags behind the stored consent decision.
Privacy notice does not enumerate data categories shared
State consumer privacy statutes · /privacy · policy text
Several state statutes require the categories of personal information sold or shared to be listed. The current notice speaks only in generalities.
Plain language & industry
Warranty terms read at grade level 16.4
Readability benchmark · /support/warranty · body text
Consumer-facing terms target grade 8–10. Sentence-level rewrite candidates are listed per page in the full report.
Allergen information published as image-only graphics
WCAG 2.2 SC 1.1.1 + industry module · /products/nutrition · 31 images
Assistive technology cannot read allergen data rendered as images — an accessibility failure with a consumer-safety edge. Publish the same data as text.
No vulnerability disclosure channel published
RFC 9116 · /.well-known/security.txt · absent
Security researchers have no sanctioned way to report what they find. Publish a security.txt with a monitored contact.
Representative sample. Findings above are composites drawn from real scan patterns across the 6,903+ point engine; identifying details are invented. A delivered report cites the actual pages and elements of the site reviewed, includes every finding (not an excerpt), and arrives as HTML or PDF — with structured JSON available for integration. Observations reference published standards; this is not legal advice.