Moderate Risk
Overall posture reflects one urgent gap alongside routine hygiene items — see findings below.
Findings Identified
4 total
Highest Severity
Critical (1)
Review Type
Technical verification, external-only
Report Status
Final — delivered to client
Executive Summary
This review checked whether the product's public claims — privacy policy, security messaging, and core functionality — match what actually happens in production. Four findings were identified across legal accuracy, functional reliability, and infrastructure hygiene. One is rated Critical and should be addressed immediately; the rest are Medium or Low severity and can be scheduled as routine fixes.
A note on how to read this report: this is a technical verification review, not a certified compliance audit or attestation under any framework. Findings are described in plain language and, where relevant, mapped to the general area of common frameworks (SOC 2, GDPR, etc.) for your own reference — this mapping is informational, not a formal compliance determination, and should not be represented to third parties as one.
Findings
Fail-open behavior on core scanning feature
Critical
What we found
When the scanning backend fails, times out, or returns an error, the UI displays "✅ Safe" instead of an error state — a false all-clear with no scan actually performed.
Where
app/scan/results.js, lines 41–58Why it matters
A security feature that silently reports success on failure is worse than no feature at all — it actively misleads users into a false sense of safety.
Recommended fix
Any non-success backend response should render a visible error/warning state, never the "Safe" result.
Related framework area (informational)
SOC 2 — System Operations / error handling controls
Privacy policy contradicts actual data flow
Medium
What we found
The privacy policy states data is "processed locally," but network traces confirm content is transmitted to a third-party AI API.
Where
/privacy — "How We Handle Your Data" sectionWhy it matters
This is a false representation to users about how their data is handled — a legal and trust exposure, not just a technical one.
Recommended fix
Update the policy to name the actual provider and describe the real data flow.
Related framework area (informational)
GDPR — transparency & accuracy of processing disclosures
Contact form submits to a dead endpoint
Medium
What we found
The form displays a success message on every submission, but the target URL returns a 404 — no submission is ever actually delivered.
Where
Contact page, form action URLWhy it matters
Every inquiry sent through this form has been silently lost, with no error shown to the user or the business.
Recommended fix
Point the form at the current backend, and add basic delivery confirmation/logging.
Related framework area (informational)
SOC 2 — Availability / reliability of business processes
Stale DNS record from prior infrastructure migration
Low
What we found
A subdomain still resolves to infrastructure that was decommissioned during a prior migration.
Where
DNS zone, CNAME recordWhy it matters
Low immediate risk, but stale records are a common source of subdomain takeover vulnerabilities if left unaddressed.
Recommended fix
Remove the unused record.
Related framework area (informational)
General infrastructure hygiene — not tied to a specific framework clause
Framework Reference Summary
For your convenience, findings above are informally mapped to the general area of common frameworks they relate to. This mapping is provided as context only — it is not a certified assessment against any framework, and no attestation is being made.
| Framework | General Area Referenced |
|---|
| SOC 2 | System operations, error handling, availability |
| GDPR | Transparency and accuracy of data-processing disclosures |
Scope & Limitations
This review covered the product's public-facing surfaces available during the review window. It is a technical verification review — not a formal compliance audit, certification, attestation, or penetration test — and does not guarantee identification of every possible issue. Framework references above are informational only and do not constitute a certified compliance determination. See the full Services Agreement for complete scope terms.