Audit rules

The Audits view looks at your project and at a running page. Security audits read your project, and accessibility and SEO audits read a running page. This page lists what each audit looks for. The view itself is introduced in Features.

Every report starts at 100. Each finding lowers the score by its severity, and findings are sorted from most severe.

The scan covers files tracked by git, up to 1 MB. The value is masked in the report, and lines that look like an example or placeholder are skipped.

These rules skip test and fixture folders. Every finding has a file, a line and a suggested fix.

The app reads exact versions from package-lock.json, composer.lock, pinned requirements*.txt and poetry.lock, then checks them against OSV.dev. Only package names and versions are sent, never code. Without a network, the audit still finishes with results from the rules.

The page loads in a hidden window, and axe-core runs with the WCAG 2.0, 2.1 and 2.2 tags and best-practice rules. Each rule lists up to eight elements.

Select findings and choose Fix with agent. A new or running agent gets a short list of up to 40 items, not the whole report, and it makes no commit.

Security audit for shop found 3 problems. Fix them in the code, starting with the most severe:
1. (critical) GitHub token [scripts/release.sh:12]
2. (high) SQL query built from strings [orders/reports.py:41]
3. (medium) HTML inserted without sanitization [src/components/ProductDescription.tsx:8]

• Features: all views, grouped by job.
• Skills catalog: audit skills that run from any agent.
• Data and network: what audits send, and where.