What we've been building.
Following a responsible-disclosure report, our web server now refuses connections that don't use one of our domain names and no longer reveals its software version, and www.auditsu.com now sends the HSTS header that tells browsers to always use HTTPS, like our other domains.
Thanks to Muhammad Uzair Khan on LinkedIn, whose report prompted this.
Limits on sign-up and sign-in attempts are now applied consistently: sign-up, password sign-in and Google sign-in share one limit, counted across all our servers.
Thanks to Sugish Devkota on LinkedIn, whose report prompted this.
Email verification links now work once and cannot be used for anything else, and the password rules that already applied when you change or reset a password now also apply when you sign up or accept an invitation.
Thanks to Sakar Bhandari on LinkedIn, whose report prompted this.
If a logout request fails, the app now keeps you signed in and tells you, instead of sending you to the login page while your session is still active.
Thanks to Sugish Devkota on LinkedIn, whose report prompted this.
Your pages now keep a fixed order, and the walkthrough follows it: checks count up in sequence, and finishing a page takes you straight to the next one on the list. Imported pages are screened before their walkthrough begins, and the questions asked once per audit are labelled Site level or App level to match what you are auditing.
Recording a verdict no longer reloads every finding in the audit, and the results screen stays in sync as you work. Pages are grouped by their place in your site, which keeps large audits quick to open and easy to find your way around.
Failing a check now records the verdict and its ticket in one step, so a failed check can no longer end up without a ticket. If the ticket cannot be prepared, nothing is recorded and you are told, and the results screen flags any older failed check that has no ticket.
The app now sends standard security headers, so no other website can load it inside a frame. Published accessibility statements are the one exception, so the embed code you place on your own site keeps working.
A published statement now says when it no longer matches the audit behind it, and the public page notes when verdicts changed after publication. You can re-audit a page while the statement is live: it stays published, shows that its audit is incomplete, and is republished once you complete the audit again.
When you fail a check, the observation you write goes straight onto its ticket, and you can drop a screenshot anywhere on the page to attach it. On phones, the verdict controls now stay pinned to the bottom without taking over the screen.
