Proof
Every figure below came from running the shipped engine against a real target. You can reproduce all of them from the repository.
6 pages · 12 links checked · 45 keyboard stops · 34.7s
Finds the exposed .env with a Stripe key, a 500 from its own API, an uncaught exception, an unreachable sign-up button, five dead internal links, and a pricing table that overflows on mobile.
5 pages · 140 links checked · 222 keyboard stops · 52.5s
Zero blockers, as you would hope. Getting this number right mattered more than getting it high — two false positives showed up on the first run here and both were fixed before shipping.
3 pages · 325 links checked · 450 keyboard stops · 90.2s
689 separate faint-text elements across three pages collapsed into a single finding, because they share one cause. Thirteen findings you can act on instead of a list of 689 symptoms.
6 files scanned · under 1s
Hardcoded Stripe and AWS keys, SQL built by concatenation, jwt.decode without verification, a payment amount trusted from the client, a login route with no rate limiting. Every secret masked in the output.
The one that mattered most
It found eight real problems in this very site — no Content Security Policy, no frame protection, no share preview, no robots.txt, a framework version disclosed in a header, and an 11px label its own mobile check flagged as too small to read. All eight are fixed.
It also caught a bug in itself: bypassing CSP to inject the auditor was hiding CSP-caused errors on every site we scanned. That is why the scan now runs in two passes.
The site you are reading is audited the same way. Adding these pages introduced a bug immediately — the new navigation shipped 44×23px tap targets, one pixel under the WCAG 2.2 minimum — and Axiom's own mobile check caught it before it went out.
$ npm run scan -- http://localhost:3000
4 pages · 28 keyboard stops · 25.9s
0 blocker · 0 serious · 0 moderate · 0 minorOn Hacker News, 689 elements across three pages fail contrast — but they all inherit the same grey from the same stylesheet. Reporting that 689 times is a wall you scroll past. Axiom merges findings by cause and lists the places, so you get one line to change.
Text is too faint to read 689× 3 pages
#828282 on #f6f6ef 3.54:1 → #6f6f6f 4.52:1WCAG defines relative luminance as a pure function of sRGB, so the minimal correction can be solved for rather than guessed at. Axiom binary-searches lightness in HSL space for the smallest shift that clears the threshold while preserving hue — no API key, no model call, the same answer every run.
#777777 on #ffffff 2.85:1 → #767676 4.54:1 lightness moved 0.4%
#999999 on #ffffff 2.85:1 → #767676 4.54:1 lightness moved 13.7%
#0000ff on #000000 2.44:1 → #5e5eff 4.52:1 hue preservedThe solver independently arrives at #767676 — the canonical minimum-passing grey on white — from a 0.4% shift. Asserted against published reference values by npm run test:contrast.
git clone https://github.com/thesurajgupta/axiom && cd axiom
npm install && npx playwright install chromium
npm run fixture # the demo site, in one terminal
npm run scan -- http://localhost:4321
npm run audit:demo # the vulnerable codebase
npm run verify:catalog # the check list matches the engine
npm run test:contrast # the WCAG maths matches the spec