CRO&SUM Audits
Sample Report

Detailed Audit Findings

This sample report illustrates the actual layout, matrix categorizations, severity flags, and recommended actions compiled by our audit scanner.

Audit Report — acme-saas.io
Executive Summary

acme-saas.io — Full Stack Audit

Audited: June 2, 2026 · 47 categories · 18 checks run

This audit identified 4 critical, 9 high, 14 medium, and 6 low severity issues across CRO, Security, and SUM categories. Immediate attention required on authentication and checkout flow.

72
CRO
48
Security
61
SUM
Critical & High Priority Findings (5)
Critical
CSRF protection missing on checkout form
Security → Authentication
Critical
Debug endpoint exposed: /api/debug returns stack traces
Security → Logging
High
Primary CTA not visible above fold on 375px viewport
CRO → Mobile
High
No rate limiting on /auth/login — brute force possible
Security → Authentication
High
SSL certificate expires in 14 days, no auto-renewal
SUM → CDN,
Medium
Checkout form has 12 fields — industry avg is 5
CRO → Forms
Medium
Missing Content-Security-Policy (CSP) headers
Security → Security
Low
404 Page lacks custom branding and fallback redirect links
CRO → Error
Priority Matrix — Effort vs Impact
Do First · Low Effort, High Impact
CSRF protection missing on checkout form · Debug endpoint exposed: /api/debug returns stack traces · Checkout form has 12 fields — industry avg is 5
Plan · High Effort, High Impact
Primary CTA not visible above fold on 375px viewport · No rate limiting on /auth/login — brute force possible · SSL certificate expires in 14 days, no auto-renewal
Quick Wins · Low Effort, Medium Impact
Missing Content-Security-Policy (CSP) headers · 404 Page lacks custom branding and fallback redirect links
Backlog · Low Priority
Improve static 404 page navigation · Audit sitemap redirect nodes.
Detailed Findings & Recommendations
CriticalCSRF protection missing on checkout form
Authentication & Session Security

The POST checkout registration route accepts requests without checking validation tokens, making it open to Cross-Site Request Forgery.

Recommendation:

Inject a verified CSRF input token to the page forms and check headers server-side.

CriticalDebug endpoint exposed: /api/debug returns stack traces
Logging & Debug Exposure Checks

The API endpoint /api/debug is accessible in the production build, outputting raw ENV configurations, server stack details, and API keys.

Recommendation:

Disable logging endpoints in production builds. Restrict access behind IP firewall.

HighPrimary CTA not visible above fold on 375px viewport
Mobile UX & Responsive Experience

The landing page CTA button is pushed below 600px of content on mobile devices due to large height spacing, leading to drop-offs.

Recommendation:

Reposition the primary CTA inside the initial header block for small screens.

HighNo rate limiting on /auth/login — brute force possible
Authentication & Session Security

The authentication endpoint permits infinite sequential requests, allowing attackers to cycle passwords.

Recommendation:

Configure rate limiting on login routes (e.g. limit to 5 attempts per IP per minute).

HighSSL certificate expires in 14 days, no auto-renewal
CDN, DNS & SSL Validation

The primary SSL certificate is set to expire in two weeks. No automatic Let's Encrypt renew task is enabled.

Recommendation:

Configure SSL auto-renewal on Vercel or your hosting platform.

MediumCheckout form has 12 fields — industry avg is 5
Forms & Registration UX

The purchase workflow requests name, business details, telephone, and questionnaire fields, increasing cognitive friction.

Recommendation:

Consolidate forms, delay profile details collection to post-purchase onboarding pages.

MediumMissing Content-Security-Policy (CSP) headers
Security Headers & Browser Policies

No CSP header is set, permitting the loading of styles and script dependencies from arbitrary external locations.

Recommendation:

Define a secure Content-Security-Policy header in your next.config.js or middleware.

Low404 Page lacks custom branding and fallback redirect links
Error & Empty State UX

Default server 404 page shows without home redirects or help search bars.

Recommendation:

Create a branded 404.tsx page with main navigation fallback links.