Defensible website audits
Obcend produces deterministic, evidence-backed findings. When a client or their developer challenges your audit, you open the exhibit — and the conversation ends.
No sampling · no heuristics · reproduced every run
No Content-Security-Policy header on authenticated document responses
The problem with audits
An audit is only worth what it can survive.
You deliver findings. Someone disputes them — wrong, out of date, or “your tool made that up.” If you can’t produce the proof in the moment, the engagement and your credibility take the hit. Most tools hand you a list. A list doesn’t hold up when it’s challenged.
Why it holds up
These are not features. They are constraints the system is built under — and they are what separates an audit from an opinion.
The same site, the same ruleset version, the same result. Deterministic by construction — no sampling, no model output, no run-to-run drift.
Every finding carries the artifact it was derived from. Nothing is asserted without the captured response that proves it.
When a vendor, a client, or an auditor challenges a finding, you open the evidence appendix and the conversation ends.
Anatomy of a finding
Not a flag on a dashboard — a record built to be handed to someone who doesn’t trust you yet.
No Content-Security-Policy header on authenticated document responses
The measured value against the required one — not a grade, a fact.
The URL and the location in the response the value came from.
Hashed and immutable. This is the thing you open when someone says “prove it.”
Same result on every run, judged against a named ruleset version.
When they push back
Share the finding. They open the captured response themselves. There is nothing left to debate.
The loop is closed
Because the ruleset is versioned, the trend is honest. A finding clears on the next run against the same ruleset, or it does not — and you can see exactly why. That’s a retainer you can defend month after month.
A scoped, rate-respecting crawl. Scope, depth, and concurrency are declared up front and recorded with the run.
Each response is measured against a versioned ruleset. A rule matches the captured artifact, or it does not.
Every match stores the exact artifact that produced it — hashed and immutable.
Computed from findings by a published formula. Open any score and trace the findings and weights behind the number.
The finding carries observed value, expected value, and location — an engineer can act without a discovery meeting.
Who it’s for
Anyone whose name is on the report, in front of someone who will question it.
Defend findings to a client’s in-house team without a fight.
Hand over an audit that holds up long after the invoice.
Show progress across a portfolio with a trend you can trust.
Every claim traceable to the response that proves it.
See a finding you could put in front of a skeptical engineer and win.