We ran our own audit on this site
2 September 2026 · full site · no mercy mode · second pass same day
Good bones. Several Giants would reject this. Below is the whole thing — scorecard, three ship-blockers, and what we did about them.
Every resource site tells you to hold your code to a standard. This is the only one we know of that publishes the standard, runs it on itself, and shows the result including the parts that fail. A site scoring itself 95% would tell you nothing. This one scored 61%.
The Titan Audit scores a codebase against the qualities of the most valuable companies on earth — each mapped to something testable, not a metaphor. You can run it on your own project from the Prompt Deck on the home page, in four modes.
What we measured
| Metric | Value |
|---|---|
| Total payload | 234 KB across 6 pages, static, no backend |
| Largest file | index.html — 2,956 lines |
| Test files | 0 |
| Analytics | None loaded |
| Content visible without JavaScript | 11% — 975 of 8,860 characters |
| Secrets in source | None |
Scorecard
| Giant | Avg | Critical finding |
|---|---|---|
| Disney | 8.3 | Nothing. Best dimension on the site. |
| Ferrari | 8.0 | Distinctive and hand-made — but JS-gated |
| Home Depot | 7.3 | No contributor docs, no error copy |
| AMD | 7.3 | Graceful degradation genuinely well done |
| Bank of America | 7.0 | 34 touch targets under 44px; no skip link |
| Microsoft | 6.3 | No build step, no automation |
| Netflix | 6.0 | Nothing personalised; no data to do it with |
| Palantir | 6.0 | Cannot answer “what happened” |
| Apple | 5.7 | 2,956-line file; tokens duplicated six times |
| Amazon | 5.7 | No error or empty states |
| Berkshire | 5.7 | One design system copy-pasted into six files |
| JPMorgan | 5.3 | No revenue mechanism is actually live |
| Johnson & Johnson | 4.7 | Privacy policy described features that did not exist |
| NASA | 4.3 | No metrics, no flags, no way to know what works |
| Eli Lilly | 3.7 | Zero tests. Zero monitoring. |
The three ship-blockers
P089% of the site was invisible to AI crawlers
Measured: 975 characters rendered without JavaScript, 8,860 with. The toolbox, the prompt deck and the word of the day were all built client-side. Google renders JavaScript. GPTBot, ClaudeBot and PerplexityBot largely do not. A site whose whole argument is that it deserves to be cited had built itself so the citing systems could not read it.
Fixed. There is now a build step that pre-renders every section into the HTML. Content visible without JavaScript went from 11% to 100%. There is also an llms.txt carrying the entire site as plain text.
P0The privacy policy described things that did not exist
It claimed outbound clicks were counted through a /go/ redirect — there was no such
route. It claimed aggregate analytics — none were installed. It promised a consent banner —
there was no consent code on any page. A privacy policy describing processing you do not perform is a
false statement in a legal document.
Fixed. The policy now says plainly that the site sets no cookies, runs no advertising, and has no affiliate links, and describes what will change before any of that starts.
P0The only contact address did not exist
Five mailto: links across three legal pages pointed at a mailbox that had never been
created. A privacy contact route that bounces is worse than none.
Fixed. Mailbox created and MX/SPF records live; a test message from an outside account was received on 2 September 2026.
Closed since the audit
Same day, second pass. Each line below is checked by a script that fails the build if it stops being true
(test.sh in the repo: build gate, unit tests, static checks, a headless browser with axe, and an
end-to-end run of the Vibe Check).
| Finding | Was | Now | Checked by |
|---|---|---|---|
| Tests | 0 | 8 unit + 22 end-to-end assertions + 9 pages of static and browser checks | test.sh |
| Text visible without JS | 11% | 98–113% on every page (measured innerText, JS off vs on) | site_check.py |
| Design tokens | copied into 6 files | one file, chrome.css; a page that defines its own :root fails the build | static check |
| Header | 3 different headers | one header, one footer, generated for all 9 pages; nav text compared across pages in a browser | browser check |
| Canonical URL | apex, while apex redirects to www | https://www.vibebrator.com/… everywhere: canonical, og:url, sitemap, robots, llms.txt, JSON-LD | static check |
| Header CTA | pointed at a newsletter that does not exist | points at the Vibe Check, which does | 246 internal links resolved |
| Affiliate disclosure | “Some links pay us” while the policy said none do | removed; the policy and the page agree | static check |
| Hero counters | “142 prompts”, invented | derived from the data files at build time (20 prompts, 95 tools, 60 terms) | build |
| Toolbox duplicates | “Hugging Face” ×4, “McStumble” ×2 | named for what they are; duplicate names or slugs fail the build | static check |
| Legal pages | different header, no og:image/og:url/twitter card | same chrome and full metadata as every other page | static check |
| /stack without JS | four dashes where the text should be | rebuilt as a vector building; every floor and card is in the markup, 100% visible, fully usable without the animation library | browser check + 36 e2e assertions |
| axe (WCAG 2.1 AA) | not run | 0 violations on 9 pages; card contrast and a nested-interactive SVG were fixed to get there | axe-core 4.10 |
| Contact mailbox | did not exist | hello@vibebrator.com receives mail (MX + SPF verified via public DNS, test message delivered) | manual, 2 Sept |
| Console errors | not measured | 0 on 9 pages with the CDN blocked | browser check |
Still open
P1Zero monitoring. If the deck breaks for every Safari user tomorrow, we find out when someone tells us. Adding it means changing the privacy policy first.
P1No revenue mechanism is live. Two ad slots are reserved in the homepage markup and switched off. They stay off until a consent platform, a truthful policy, and the mailbox exist, in that order.
P2Interactive elements under 44px. Every control now clears the 24px WCAG 2.5.8 floor; 6 to 40 per page are still under the 44px target, mostly filter pills.
P2The homepage file is large — 330 KB before compression, because 95 wireframe previews are inlined as SVG so the page works without JavaScript. Compressed on the wire it is a fraction of that; it is still the next thing to measure.
What scored well
Graceful degradation. Every animation is guarded; the page is fully functional with the animation CDN blocked, and a three-second safety net force-shows anything a failed observer left hidden.
Contrast. Five of six colour tokens pass WCAG AA, four above 8:1. The sixth measured 4.14:1 and was lifted.
Accessibility fundamentals. Landmarks, one h1, language set,
zero unlabelled buttons, zero unlabelled SVGs, zero images without alt text.
No attack surface. No backend, no auth, no user input reaching anything.
Why publish a 61%
Because the alternative is asking you to verify ruthlessly while hiding our own numbers. The gap between a site that says “hold your code to a standard” and one that shows its own score is the entire difference between a content farm and something worth reading.
Next target: 78% — Contender. We will publish that one too, including whatever it finds.