PushFix
284 checks · 10 families

Every check, in one versioned catalogue

A single review covers the security pass, the launch checklist, the SEO audit and the accessibility review you were going to do separately. Here is exactly what runs.

See the security checks
  • Free during early access
  • No credit card
  • Staging-first
  • Evidence for every finding
Ten families

One catalogue, ten disciplines

Every check is externally observable: an HTTP response, a rendered DOM, a screenshot, a console message, a network request, DNS or TLS. Nothing depends on reading your source.

Security

136

Access control, secrets, sessions, headers, infrastructure, APIs, privacy.

Vibe-code failure modes

26

The ways generated software specifically breaks: placeholders shipped, UI-only auth, demo data live.

SEO

16

Titles, metadata, canonical tags, robots, sitemaps and structured data.

Production readiness

18

Favicons, web manifest, domain hygiene, error pages, monitoring hooks.

Functional

17

Status codes, links, forms, navigation and failure handling.

UI and layout

15

Layout integrity, responsive breakpoints, overlapping and clipped content.

Accessibility

14

Keyboard paths, focus order, contrast, semantics and announcements.

Compliance

18

Cookie banners, consent, disclosures and required legal affordances.

Content

12

Placeholder copy, template tokens and runtime values leaking into pages.

Performance

12

Core Web Vitals, payload size, compression and caching.

Security leads

136 of the 284 checks are security checks

Most serious bugs in generated apps are missing ownership checks and exposed credentials, not exotic exploits. The security family is the largest by design, split into nine sub-families.

How the security review works

  • Authorization and access control22
  • Headers and transport20
  • Secrets and credential exposure15
  • Infrastructure and configuration15
  • API behaviour15
  • Session lifecycle13
  • Injection indicators13
  • Privacy and data flows9
  • Client-side sinks9
  • Third-party services and keys5
Profiles

How deep the review goes

Profiles gate capabilities, not check ids: browser, API, authenticated roles, visual diffs and AI. The higher profiles are supersets of the lower ones.

Quick

157 checks

The essentials for a first pass: structure, SEO, headers, accessibility and performance.

No AI spend

Standard

222 checks

Adds browser testing, API testing, network inspection and responsive viewports.

No AI spend

Full

Deepest
284 checks

Everything, including authenticated testing across roles, visual diffs and AI exploration.

AI-assisted

Compare plans and pricing →
What is not covered

Honest about the 137 checks still being built

147 of 284 checks execute today. A catalogue entry without an evaluator is reported as not implemented, never as passed, and every report states the split explicitly.

01

Reported, never assumed

The report and the audit's coverage record list which checks ran, which were skipped by policy and which are not implemented yet. A gap is never dressed up as a pass.

02

Retired, never deleted

Renamed or removed checks are marked retired so an older report still reproduces exactly. You can always tell why a past audit said what it said.

Why the other 137 are not running yet

  • Needs rendered layout or interaction in a browser84 checks
  • Needs a signed-in account23 checks
  • Needs AI judgement18 checks
  • Needs a request we will not send without your permission12 checks
Platforms

Websites and APIs today, apps later

Reviewing a native app means installing it on real devices, driving it and reading its logs. That is a different product from the one that audits a URL, so we would rather say so than sell an audit that cannot run.

Websites and web apps

Supported

Every page a visitor can reach, including sign-in flows, dashboards and the JavaScript that runs in the browser.

APIs and backends

Supported

REST and GraphQL endpoints we discover from your own pages, bundles and OpenAPI specs, plus headers, DNS, TLS and email records.

iOS apps

Coming soon

Requires installing your build on real devices, which we cannot do well yet. Coming soon.

Android apps

Coming soon

Same device constraint as iOS. Coming soon.

Windows, macOS and Linux desktop apps

Coming soon

Coming soon.

Browser extensions

Coming soon

Coming soon.

Try it

Run the catalogue
against your own app.

The free review runs the deterministic half of the catalogue and shows you the shape of a PushFix report.

Start a free review

Prefer to look around first? Compare plans