What an audit actually contains.

250+ deterministic rules. AI critique on request. One Secly Score.

Deterministic checks first; AI interpretation on top. Plain-English findings, copy-paste fix-prompts, and a Secly Score you can share.

AUDIT SCOPE

Six categories. 250+ rules.

Every rule is documented, ranked by impact, and re-runnable on demand. New rules deploy behind the rule library so existing scores stay comparable across rebuilds.

Performance

Core Web Vitals, bundle weight, render-blocking assets, third-party drag, image budgets.

Accessibility

WCAG 2.2 AA — contrast, ARIA roles, keyboard order, focus traps, heading structure.

SEO & AEO

Crawlability, canonicals, structured data, meta hygiene, AI-engine answer readiness.

Security

Headers, CSP, mixed content, exposed framework versions, leaked endpoints.

Best Practices

Modern HTML, deprecated APIs, console errors, broken assets, console-leaked secrets.

Aesthetics

Spacing rhythm, type scale consistency, alignment, visual hierarchy, brand cohesion.

HOW YOU CALL IT

One HTTP call. One signed report.

Secly is a private invite-only scan-engine-as-a-service. One POST /v1/scans with the URL you want audited, one signed webhook back with the report, screenshots, and the Secly Score. Bake it into your CI, your client onboarding, or your platform.

WHAT YOU GET

  • All 250+ deterministic rules
  • HTML + JS rendering on hosted browsers
  • Secly Score, identical methodology every call
  • Copy-paste fix-prompts for every finding
  • Signed webhook delivery — JSON + screenshots
  • Re-run on every deploy

HOW IT FITS

  • Bearer-token auth — no Clerk, no dashboard
  • HMAC-signed screenshot URLs
  • Webhook signature with replay protection
  • Per-key rate limits + daily quota
  • Frozen scan_report.v1 schema
  • Invite-only access — talk to us

HOW THE SCAN RUNS

Two passes. Independent. Comparable.

A deterministic pass produces objective findings — boolean, numeric, repeatable. An AI pass produces subjective findings on the visual rendering. The two passes are kept separate so a single LLM hiccup never silently changes a score.

DETERMINISTIC

Rules engine.

  • Headless render of the URL (HTML or JS-rendered).
  • 250+ rules evaluated against the resolved DOM, headers, and computed CSS.
  • Every rule has a stable id, a category, an impact, and a documented detection method.
  • Same input, same output — across runs, accounts, and tiers.

AI CRITIQUE

Visual reviewer.

  • Full-page screenshot fed to Claude Sonnet 4.6 with a calibrated visual-critique prompt.
  • Findings include layout, hierarchy, copy clarity, and brand cohesion.
  • Flags issues a rules engine can't see — "this CTA reads like a footer link".
  • Each finding tagged so you can filter or hide the AI pass entirely.

SCREENSHOTS & CRITIQUE

Looks matter. They get graded.

Every audit captures a full-page screenshot at a real viewport. The image is graded against an aesthetic rubric — spacing rhythm, type scale, hierarchy, contrast, brand cohesion — and the findings cite the exact region of the screenshot they refer to.

Screenshots are kept for the lifetime of the project. Deleting a project deletes the screenshots.

FIX-PROMPTS

Every finding comes with the prompt that fixes it.

Most audit tools end at the finding. Secly ends at the patch. Each finding includes a copy-paste fix-prompt — a structured instruction tuned for a code-aware AI editor. Paste it into Cursor, Claude, Replit Agent, or your assistant of choice.

FINDING / SEO & AEO / HIGH IMPACTOpen

Missing canonical URL on /product

Search engines cannot resolve the canonical version of this page. Risk: duplicate-content suppression and fragmented link equity across query-string variants.

FIX-PROMPT

Add a canonical link tag to artifacts/secly-web/index.html
that resolves to https://secly.com/product. Use the existing
meta-tag insertion pattern in server.ts so it stays consistent
with the other per-route overrides. Verify the rendered HTML
emits a single <link rel="canonical"> per page.

SECLY SCORE

A score that travels.

One number from 0 to 100. Computed from the six category sub-scores under a fixed weighting that does not change across tiers or rebuilds. Drop it on a status page, a pull-request comment, a client invoice — it is the same score everywhere.

91

of 100

DELIVERABLES

Three formats. One source of truth.

Every audit is rendered into three deliverables, each tuned for a different audience. The underlying findings are the same — only the presentation differs.

For sharing.

HTML report

A standalone shareable URL. Findings, screenshots, and the Secly Score, all on one page. Send it to a client. Drop it in a PR.

For your editor.

Markdown report

Every finding and fix-prompt in plain Markdown. Paste into Cursor, Claude, Replit, or your repo's CHANGELOG. Machine-readable.

For invoices.

PDF report

The same findings, typeset for print. Use it as evidence in a consulting deliverable, an audit invoice, or a procurement review.

READY?

See the depth on your own URL.

Secly is an early prototype. Access to the scan-engine API is invite-only — tell us where you want it baked in and Steve will reply within a working day.