Catalog

139 checks,
every audit.

70 checks written for Axiom, plus the 69 axe-core rules tagged WCAG 2.1 A/AA that run on every page. This list is generated from the engine's own finding ids and asserted against the source in CI, so it cannot drift into marketing.

npm run verify:catalog

What broke while it ran

4 checks

Console and network listeners attached before navigation, so the earliest failures are captured.

What broke while it ran: check name, what it detects, and severity
Check	What it detects	Severity
Uncaught JavaScript exception	Something threw during load and nothing handled it	Blocking
Your API returning 5xx	An endpoint the page depends on failed server-side	Blocking
Files that 404	Images, scripts or stylesheets that never loaded	Moderate
Console errors	Errors your own code logged that nobody is reading	Moderate

Whether a keyboard works

4 checks

Real Tab keypresses through the page, recording every focus stop — not a DOM read.

Whether a keyboard works: check name, what it detects, and severity
Check	What it detects	Severity
Controls nobody can reach	Interactive elements that never receive focus	Blocking
Invisible focus	Focusing the element changes nothing on screen	Blocking
Keyboard traps	Focus enters a region and cannot Tab back out	Blocking
Illogical tab order	Focus jumps far back up the page mid-sequence	Moderate

How it behaves on a phone

3 checks

The page re-rendered at 390×844 and measured.

How it behaves on a phone: check name, what it detects, and severity
Check	What it detects	Severity
Sideways scrolling	Content extends past the right edge of the viewport	Serious
Tap targets under 24px	Controls too small to hit reliably (WCAG 2.2)	Moderate
Text under 12px	Body copy too small to read on a handset	Moderate

Every link on the site

2 checks

Each unique URL requested once — HEAD first, falling back to GET — across every page found.

Every link on the site: check name, what it detects, and severity
Check	What it detects	Severity
Internal links to nowhere	Links to your own pages that return 404 or 5xx	Serious
Dead outbound links	Links to other sites that no longer resolve	Moderate

What the server gives away

13 checks

Response headers, cookie flags and well-known paths — read, never attacked.

What the server gives away: check name, what it detects, and severity
Check	What it detects	Severity
No Content Security Policy	Missing the main defence against cross-site scripting	Serious
HSTS not enabled	First request can be downgraded to plain HTTP	Serious
Site can be framed	Clickjacking is possible on sensitive actions	Serious
MIME sniffing allowed	Browsers may execute a file you served as text	Moderate
Full URLs leak	Your paths and query strings sent to third parties	Minor
Stack disclosed	Server headers naming your software and version	Minor
HTTP doesn't redirect	Plain HTTP serves content instead of upgrading	Serious
Mixed content	HTTPS page pulling resources over plain HTTP	Serious
Cookies without Secure	Session cookies transmittable in the clear	Serious
Cookies readable by JS	Any script on the page can steal the session	Serious
Cookies without SameSite	Exposed to cross-site request forgery	Moderate
Exposed .env / .git	Secrets publicly downloadable right now	Blocking
Public source maps	Your original source reconstructable by anyone	Moderate

What you forgot before launch

11 checks

The rendered document head, plus robots.txt and sitemap.xml.

What you forgot before launch: check name, what it detects, and severity
Check	What it detects	Severity
Still set to noindex	A staging directive that shipped to production	Blocking
robots.txt blocks everything	Disallow: / hiding the whole site from search	Blocking
No viewport tag	Phones render at desktop width and zoom out	Serious
No page title	Blank tab, blank search result, blank bookmark	Serious
No share preview	Links render as a grey box when shared	Moderate
No meta description	Google invents your search snippet	Moderate
No main heading	Screen readers and crawlers can't find the topic	Moderate
Multiple h1 elements	An ambiguous document outline	Minor
No favicon	A blank icon in the browser tab	Minor
No robots.txt	Nothing telling crawlers what to skip	Minor
No sitemap.xml	Discovery relies entirely on internal links	Minor

How slow it is

3 checks

The browser's own navigation and resource timing.

How slow it is: check name, what it detects, and severity
Check	What it detects	Severity
Slow first paint	Users stare at a blank screen past 3 seconds	Moderate
Heavy page weight	Megabytes shipped for the first screen	Moderate
No compression	Text served without gzip or brotli	Moderate

Secrets in your source

11 checks

Format-specific patterns over your files. Every match is masked before it is ever displayed.

Secrets in your source: check name, what it detects, and severity
Check	What it detects	Severity
AWS access key	AKIA-prefixed credentials in code	Blocking
Stripe live key	sk_live_ keys that can move real money	Blocking
OpenAI key	sk- / sk-proj- API credentials	Blocking
Anthropic key	sk-ant- API credentials	Blocking
GitHub token	ghp_ / github_pat_ tokens	Blocking
Private key	PEM-encoded RSA, EC or OpenSSH keys	Blocking
DB URL with password	postgres:// and friends with inline credentials	Blocking
Google API key	AIza-prefixed keys	Serious
Slack token	xoxb / xoxp workspace tokens	Serious
Hardcoded JWT secret	A signing secret anyone can forge tokens with	Serious
Generic API key or password	Long literal assigned to a key/password name	Serious

Injection, auth and payment bugs

15 checks

Pattern analysis over your source. Reports the dangerous shape it detected, never a claim of proven exploitability.

Injection, auth and payment bugs: check name, what it detects, and severity
Check	What it detects	Severity
SQL injection	Queries assembled by string concatenation	Blocking
Command injection	Shell commands built from a variable	Blocking
Unverified JWT	jwt.decode without checking the signature	Blocking
Client-set payment amount	Charge amount taken from the request body	Blocking
TLS verification off	rejectUnauthorized:false or NODE_TLS_REJECT_UNAUTHORIZED=0	Blocking
No rate limit on auth	Login/reset routes with no throttling referenced	Serious
Unverified Stripe webhook	Webhook handled without constructEvent	Serious
Path traversal	File paths built from request input	Serious
Weak password hashing	MD5 or SHA-1 used on passwords	Serious
XSS via raw HTML	dangerouslySetInnerHTML with a variable	Serious
eval / new Function	A string executed as code	Serious
Unsafe CORS	Any origin allowed together with credentials	Serious
Open redirect	Redirect target taken from request input	Moderate
Raw error to client	Stack traces and internals returned to the browser	Moderate
Debug mode on	Framework debug flags left enabled	Moderate

Dependencies and config

4 checks

Your manifest, lockfile and .gitignore — read entirely offline.

Dependencies and config: check name, what it detects, and severity
Check	What it detects	Severity
.env not git-ignored	An environment file likely tracked in git	Serious
Dependencies from URLs	Packages pulled from git/http, skipping integrity checks	Moderate
No lockfile	Installs can resolve to versions you never tested	Moderate
Install scripts	Code that runs automatically on npm install	Minor

Plus the axe-core WCAG ruleset

On top of the checks above, every page is run through axe-core's 69 rules tagged WCAG 2.1 A/AA — colour contrast, form labels, image alternatives, ARIA validity, heading structure and the rest. Axiom rewrites the ones it recognises into plain language and computes the exact fix where the maths allows.

139 checks,every audit.

What broke while it ran

Whether a keyboard works

How it behaves on a phone

Every link on the site

What the server gives away

What you forgot before launch

How slow it is

Secrets in your source

Injection, auth and payment bugs

Dependencies and config

Plus the axe-core WCAG ruleset

139 checks,
every audit.