TesterBot — QA report

What this means

This file should not be served to the internet. It usually gets exposed by deploying the whole working directory.

Where

http://localhost:8099/.env

Evidence

{
  "status": 200,
  "excerpt": "DB_PASSWORD=hunter2\nAPI_KEY=sk-test-123\n"
}

Suggested fix

What this means

This page is linked from the site but does not load successfully.

Where

http://localhost:8099/broken

Evidence

{
  "status": 500
}

Suggested fix

What this means

A JavaScript exception was raised as a direct result of clicking this control, so the feature behind it is broken.

Where

http://localhost:8099/

Element

#boom

Evidence

{
  "message": "window.missingFunction is not a function",
  "stack": "TypeError: window.missingFunction is not a function\n    at HTMLButtonElement.<anonymous> (http://localhost:8099/:24:10)",
  "control_html": "<button id=\"boom\">Show offers</button>"
}

Screenshot

Suggested fix

What this means

A sub-request returned HTTP 500 while loading this page. A 5xx means the server itself errored.

Where

http://localhost:8099/

Evidence

{
  "request_url": "http://localhost:8099/api/offers",
  "status": 500,
  "method": "GET",
  "resource_type": "fetch"
}

Suggested fix

What this means

All traffic, including anything typed into a form, is unencrypted and browsers will label the site 'Not secure'.

Where

http://localhost:8099/

Suggested fix

What this means

A link on the site points to a URL that answers 500.

Where

http://localhost:8099/

Also on

• http://localhost:8099/about
• http://localhost:8099/contact
• http://localhost:8099/does-not-exist
• http://localhost:8099/hidden-offer
• http://localhost:8099/login
• http://localhost:8099/pricing
• http://localhost:8099/slow

Evidence

{
  "target": "http://localhost:8099/broken",
  "status": 500,
  "link_text": "Broken",
  "found_on": [
    "http://localhost:8099/",
    "http://localhost:8099/about",
    "http://localhost:8099/contact",
    "http://localhost:8099/does-not-exist",
    "http://localhost:8099/hidden-offer",
    "http://localhost:8099/login",
    "http://localhost:8099/pricing",
    "http://localhost:8099/slow"
  ]
}

Suggested fix

What this means

The <img> resolved to a URL the browser could not render.

Where

http://localhost:8099/

Also on

• http://localhost:8099/team

Element

html > body > img:nth-of-type(1)

Evidence

{
  "images": [
    {
      "src": "http://localhost:8099/img/missing-photo.png",
      "selector": "html > body > img:nth-of-type(1)"
    }
  ]
}

Suggested fix

What this means

The browser's own required-field check was removed and the same empty submission was then accepted by the server. Anyone using a script, a modified page or an old browser can post empty/garbage records.

Where

http://localhost:8099/pricing

Also on

• http://localhost:8099/contact

Element

#nl

Evidence

{
  "required_fields": [
    "email"
  ],
  "final_url": "http://localhost:8099/subscribe-newsletter"
}

Screenshot

Suggested fix

What this means

Text that should never reach production is rendered on the page.

Where

http://localhost:8099/

Evidence

{
  "excerpt": "k This block is 1500px wide and overflows on mobile. Status: undefined"
}

Suggested fix

What this means

No navigation, no network request and no message appeared. The form looks non-functional.

Where

http://localhost:8099/pricing

Element

#noop

Evidence

{
  "fields": [
    "promo"
  ]
}

Screenshot

Suggested fix

What this means

A sub-request returned HTTP 404 while loading this page. The resource is missing or forbidden.

Where

http://localhost:8099/

Evidence

{
  "request_url": "http://localhost:8099/img/missing-photo.png",
  "status": 404,
  "method": "GET",
  "resource_type": "image"
}

Suggested fix

What this means

A sub-request returned HTTP 404 while loading this page. The resource is missing or forbidden.

Where

http://localhost:8099/team

Evidence

{
  "request_url": "http://localhost:8099/img/team.png",
  "status": 404,
  "method": "GET",
  "resource_type": "image"
}

Suggested fix

What this means

TesterBot submitted the literal text '<b>TBQA7</b>' and the page rendered it as a real bold element instead of showing it as text. Anything a user types can therefore inject markup into the page.

Where

http://localhost:8099/contact

Element

html > body > form

Evidence

{
  "submitted": "<b>TBQA7</b>",
  "rendered_back_as": "<b>TBQA7</b>"
}

Suggested fix

What this means

Screen-reader users get no description; broken images show nothing.

Where

http://localhost:8099/

Also on

• http://localhost:8099/team

Element

html > body > img:nth-of-type(1)

Evidence

{
  "images": [
    {
      "src": "http://localhost:8099/img/missing-photo.png",
      "selector": "html > body > img:nth-of-type(1)"
    }
  ]
}

Suggested fix

What this means

Icon-only or empty links are announced as 'link' with no context.

Where

http://localhost:8099/

Element

html > body > a:nth-of-type(2)

Evidence

{
  "links": [
    {
      "href": "http://localhost:8099/team",
      "selector": "html > body > a:nth-of-type(2)"
    }
  ]
}

Suggested fix

What this means

Text that should never reach production is rendered on the page.

Where

http://localhost:8099/team

Evidence

{
  "excerpt": "m ContactPricingBroken SlowLogin Dead link Team Engineering Lorem ipsum dolor sit amet, consectetur adipiscing elit."
}

Suggested fix

What this means

None of the inputs are marked required, so a completely empty submission is accepted by the browser.

Where

http://localhost:8099/login

Element

html > body > form

Evidence

{
  "fields": [
    "user",
    "pass"
  ]
}

Suggested fix

What this means

A deliberately invalid path returned a normal 200 response. Search engines index junk pages and monitoring cannot tell real pages from typos.

Where

http://localhost:8099/testerbot-does-not-exist-9f2c1a

Evidence

{
  "status": 200
}

Suggested fix

What this means

Time to first byte is dominated by server work, not the browser.

Where

http://localhost:8099/slow

Evidence

{
  "load_ms": 2011,
  "dom_ready_ms": 2011,
  "ttfb_ms": 2003,
  "transfer_kb": 1
}

Suggested fix

What this means

Content is 1524px wide in a 390px viewport, so the user has to scroll sideways. Usually one element with a fixed width or an unwrapped table.

Where

http://localhost:8099/

Evidence

{
  "viewport_width": 390,
  "content_width": 1524,
  "overflow_px": 1134,
  "widest_elements": [
    {
      "selector": "div.wide",
      "width": 1500,
      "right": 1524,
      "text": "This block is 1500px wide and overflows on mobile."
    }
  ]
}

Screenshot

Suggested fix

What this means

Content is 1524px wide in a 820px viewport, so the user has to scroll sideways. Usually one element with a fixed width or an unwrapped table.

Where

http://localhost:8099/

Evidence

{
  "viewport_width": 820,
  "content_width": 1524,
  "overflow_px": 704,
  "widest_elements": [
    {
      "selector": "div.wide",
      "width": 1500,
      "right": 1524,
      "text": "This block is 1500px wide and overflows on mobile."
    }
  ]
}

Screenshot

Suggested fix

What this means

Ensure all page content is contained by landmarks

Where

http://localhost:8099/

Also on

• http://localhost:8099/about
• http://localhost:8099/hidden-offer
• http://localhost:8099/pricing
• http://localhost:8099/team
• http://localhost:8099/contact
• http://localhost:8099/slow
• http://localhost:8099/login
• http://localhost:8099/does-not-exist

Evidence

{
  "rule": "region",
  "impact": "moderate",
  "elements_affected": 7,
  "examples": [
    {
      "target": "h1",
      "html": "<h1>Buggy Demo Shop</h1>",
      "summary": "Fix any of the following:\n  Some page content is not contained by landmarks"
    },
    {
      "target": "p:nth-child(4)",
      "html": "<p>Everything on this page is broken on purpose.</p>",
      "summary": "Fix any of the following:\n  Some page content is not contained by landmarks"
    },
    {
      "target": "img[src$=\"missing-photo.png\"]",
      "html": "<img src=\"/img/missing-photo.png\" width=\"120\" height=\"80\">",
      "summary": "Fix any of the following:\n  Some page content is not contained by landmarks"
    },
    {
      "target": "img[src$=\"logo.png\"]",
      "html": "<img src=\"/img/logo.png\" alt=\"Logo\" width=\"60\" height=\"60\">",
      "summary": "Fix any of the following:\n  Some page content is not contained by landmarks"
    },
    {
      "target": "a[target=\"_blank\"]",
      "html": "<a href=\"https://example.com/definitely-missing-page-xyz\" target=\"_blank\">External broken link</a>",
      "summary": "Fix any of the following:\n  Some page content is not contained by landmarks"
    },
    {
      "target": "div",
      "html": "<div class=\"wide\">This block is 1500px wide and overflows on mobile.</div>",
      "summary": "Fix any of the following:\n  Some page content is not contained by landmarks"
    }
  ],
  "reference": "https://dequeuniversity.com/rules/axe/4.10/region?application=axeAPI"
}

Suggested fix

What this means

Ensure the document has a main landmark

Where

http://localhost:8099/

Also on

• http://localhost:8099/about
• http://localhost:8099/hidden-offer
• http://localhost:8099/pricing
• http://localhost:8099/team
• http://localhost:8099/contact
• http://localhost:8099/slow
• http://localhost:8099/login
• http://localhost:8099/does-not-exist

Evidence

{
  "rule": "landmark-one-main",
  "impact": "moderate",
  "elements_affected": 1,
  "examples": [
    {
      "target": "html",
      "html": "<html lang=\"en\">",
      "summary": "Fix all of the following:\n  Document does not have a main landmark"
    }
  ],
  "reference": "https://dequeuniversity.com/rules/axe/4.10/landmark-one-main?application=axeAPI"
}

Suggested fix

What this means

Search engines will invent a snippet for this page.

Where

http://localhost:8099/about

Also on

• http://localhost:8099/hidden-offer
• http://localhost:8099/pricing
• http://localhost:8099/team
• http://localhost:8099/contact
• http://localhost:8099/slow
• http://localhost:8099/login
• http://localhost:8099/does-not-exist

Suggested fix

What this means

The placeholder disappears as soon as the user types, so the field loses its description.

Where

http://localhost:8099/pricing

Also on

• http://localhost:8099/contact

Element

#noop > input

Evidence

{
  "fields": [
    {
      "selector": "#noop > input",
      "type": "text",
      "name": "promo",
      "placeholderOnly": true
    }
  ]
}

Suggested fix

What this means

Duplicate titles hurt search results and make browser tabs ambiguous.

Where

http://localhost:8099/about

Also on

• http://localhost:8099/team

Evidence

{
  "pages": [
    "http://localhost:8099/about",
    "http://localhost:8099/team"
  ]
}

Suggested fix

What this means

Ensure the order of headings is semantically correct

Where

http://localhost:8099/team

Evidence

{
  "rule": "heading-order",
  "impact": "moderate",
  "elements_affected": 1,
  "examples": [
    {
      "target": "h4",
      "html": "<h4>Engineering</h4>",
      "summary": "Fix any of the following:\n  Heading order invalid"
    }
  ],
  "reference": "https://dequeuniversity.com/rules/axe/4.10/heading-order?application=axeAPI"
}

Suggested fix

What this means

A link on the site points to a URL that answers 403. (external site)

Where

http://localhost:8099/

Evidence

{
  "target": "https://example.com/definitely-missing-page-xyz",
  "status": 403,
  "link_text": "External broken link",
  "found_on": [
    "http://localhost:8099/"
  ]
}

Suggested fix

What this means

After clicking, the URL, the DOM, the network and the console were all unchanged. Either the handler is missing or the effect is invisible (e.g. copy-to-clipboard). Worth a manual look.

Where

http://localhost:8099/

Element

#dead

Evidence

{
  "html": "<button id=\"dead\">Click me</button>"
}

Screenshot

Suggested fix

What this means

After clicking, the URL, the DOM, the network and the console were all unchanged. Either the handler is missing or the effect is invisible (e.g. copy-to-clipboard). Worth a manual look.

Where

http://localhost:8099/

Element

html > body > button:nth-of-type(3)

Evidence

{
  "html": "<button aria-hidden=\"false\"><span class=\"icon\">☰</span></button>"
}

Screenshot

Suggested fix

What this means

No top-level heading was found in the rendered page.

Where

http://localhost:8099/team

Suggested fix

What this means

target="_blank" without rel="noopener" lets the opened page reach back through window.opener in older browsers.

Where

http://localhost:8099/

Element

html > body > a:nth-of-type(1)

Evidence

{
  "links": [
    {
      "href": "https://example.com/definitely-missing-page-xyz",
      "selector": "html > body > a:nth-of-type(1)"
    }
  ]
}

Suggested fix

What this means

The site does not send the Content-Security-Policy response header.

Where

http://localhost:8099/

Evidence

{
  "present_headers": [
    "content-length",
    "content-type",
    "date",
    "server"
  ]
}

Suggested fix

What this means

The site does not send the X-Content-Type-Options response header.

Where

http://localhost:8099/

Evidence

{
  "present_headers": [
    "content-length",
    "content-type",
    "date",
    "server"
  ]
}

Suggested fix

What this means

The site does not send the X-Frame-Options response header.

Where

http://localhost:8099/

Evidence

{
  "present_headers": [
    "content-length",
    "content-type",
    "date",
    "server"
  ]
}

Suggested fix

What this means

e.g. an H2 is followed directly by an H4, which confuses screen-reader navigation.

Where

http://localhost:8099/team

Evidence

{
  "skips": [
    {
      "from": 2,
      "to": 4,
      "text": "Engineering"
    }
  ]
}

Suggested fix

Where

http://localhost:8099/

Suggested fix

What this means

Links shared on social media / chat apps will have no preview.

Where

http://localhost:8099/

Suggested fix

What this means

The site does not send the Referrer-Policy response header.

Where

http://localhost:8099/

Evidence

{
  "present_headers": [
    "content-length",
    "content-type",
    "date",
    "server"
  ]
}

Suggested fix

What this means

Server/X-Powered-By reveals: BaseHTTP/0.6 Python/3.11.15

Where

http://localhost:8099/

Evidence

{
  "server": "BaseHTTP/0.6 Python/3.11.15",
  "x_powered_by": ""
}

Suggested fix

What this means

TesterBot avoids controls that look like delete / pay / logout so it cannot damage real data. Re-run with --danger-mode on a staging copy to include them.

Where

http://localhost:8099/pricing

Element

html > body > button

Evidence

{
  "html": "<button>Delete my account</button>"
}