Run your sites on facts, not vibes

An AI provider SDK is imported in code that ships to the browser, in 2 locations. The code scan flags provider clients (OpenAI, Anthropic, and others) that run outside a server boundary. Calling an AI provider from the browser exposes your API key in the bundle - anyone can extract it and run up your bill - and it can leak prompts and user data.

• src/lib/ai-client.ts

  Anthropic SDK imported in a browser bundle

• src/components/Assistant.tsx

  Provider API called directly from a client component

1. Move every AI SDK call into a server route, edge function, or backend service.
2. Read the API key from a server-only environment variable, never a public/VITE_/NEXT_PUBLIC_ one.
3. Have the browser call your own endpoint instead of the provider directly.
4. Rotate the exposed key - treat it as already compromised.

The site responds without a Content-Security-Policy (CSP) header on its HTML documents. A CSP is a primary defense against cross-site scripting and content injection. Without one, a single injected script can run with full access to your page and your users.

• https://example.com - all routes

1. Add a Content-Security-Policy response header at your server or CDN.
2. Start in report-only mode to surface violations without breaking anything.
3. Scope script-src and style-src to your own origins plus nonces or hashes.
4. Once report-only is clean, switch the policy to enforcing.

Your /robots.txt returns Disallow: / for all user-agents, telling every search engine not to crawl the entire site. Search engines can't index what they can't crawl, so a site-wide disallow can quietly drop you out of search results entirely.

• public/robots.txt

  Disallow: / under User-agent: *

1. Open /robots.txt and find the Disallow: / rule under User-agent: *.
2. Remove it, or scope it to only the paths that should stay private.
3. Explicitly allow the sections you want indexed.
4. Re-submit your sitemap in Google Search Console to speed up recrawling.

3 form inputs have no associated label and no aria-label, so assistive tech can't announce what they are for. Unlabeled inputs are a WCAG failure: screen-reader users can't tell what to type, and missing labels are a common source of accessibility complaints and legal risk.

• /contact
• /signup
• /newsletter

1. Add a <label> tied to each input's id.
2. Where a visible label isn't wanted, add aria-label or aria-labelledby instead.
3. Re-run the scan to confirm all 3 are resolved.

Images below the fold load eagerly on first paint instead of deferring until they are near the viewport. That competes for bandwidth with content the user can actually see, slowing your Largest Contentful Paint.

• / - home page, below the fold

1. Add loading="lazy" to below-the-fold <img> tags.
2. Keep your above-the-fold / LCP image eager so it isn't delayed.
3. Set explicit width and height to avoid layout shift as images load.

3 commits landed between the last two scans (a1b2c3d..e4f5a6b). 2 new findings appeared and 1 resolved. The commit range is the blame window.

1. Review the 3 commits in the blame window (a1b2c3d..e4f5a6b).
2. Open the 2 new findings to see exactly what regressed.
3. Fix or roll back, then re-scan to confirm the score recovers.

Plausible saw 41 visitors on 2026-06-14, compared with a 186/day 30-day average. Check deploys, campaigns, tracking changes, and outage history before assuming this is normal.

1. Check for a deploy or analytics-snippet change around 2026-06-14.
2. Confirm the tracking script still fires on every page.
3. Rule out an outage or a campaign that just ended.

UptimeRobot reports Production (https://example.com) is down. The latest down log has lasted 9m 12s. Check hosting, DNS, deploy status, and monitor error details before marking it resolved.

1. Check hosting and server status first.
2. Verify DNS and TLS aren't failing for the domain.
3. Confirm the latest deploy didn't break the entrypoint.