This is unedited output from our testing engine, run on our demo shop with all six patterns switched on. Each test changes one condition and checks something an honest shop has to do. In an Audit Sprint, a reviewer adjudicates every observation, and you also get a remediation list, a re-test and draft statement wording.
Not a client report. The target is our own shop, which we built to misbehave. No real business is named or tested here.
01The run
Sealed, so it can be checked
Every screenshot is stored under its own SHA-256 fingerprint, and the run is sealed in a manifest that lists every fingerprint and result. Change one pixel or one word, and the fingerprints stop matching.
Check it yourself: download the sealed manifest and compute its SHA-256 (for example, certutil -hashfile manifest.json SHA256 on Windows). It should match the value on the right. Each screenshot's file name is its own SHA-256 too.
Invariant tested: A countdown runs monotonically, shows every session the same deadline, and ends when it says.
Observed: The countdown restarted on reload instead of continuing. A fresh session was given a different deadline. The offer was still counting down after its stated deadline.
Identical screenshots. Several probes produced byte-identical screenshots, so they share one SHA-256. Content addressing proves the page looked exactly the same each time, which is the finding.
Measurement
Value
After deadline remaining (seconds)
598
After reload remaining (seconds)
599
Expected after reload (seconds)
418
First load remaining (seconds)
599
Fresh session remaining (seconds)
599
Scarcity text
Only 2 left at this price
false urgency: session A, first loadsha256 1741328f4654…false urgency: session A, after the stated deadlinesha256 033c0cdfd261…
All 4 screenshots in the record
1741328f465452e2… false urgency: session A, first load
1741328f465452e2… false urgency: session A, reload after 3 minutes
Invariant tested: No consent or add-on control is pre-selected.
Observed: Pre-selected: "Send me offers and updates on WhatsApp" (checkout); "Share my details with partner brands" (checkout) Pre-selected but not classified as consent (for review): "Billing address same as delivery address"
Measurement
Value
Controls examined
3
Pre selected consent
Send me offers and updates on WhatsApp (checkout), Share my details with partner brands (checkout)
Pre selected other
Billing address same as delivery address (checkout)
Invariant tested: A dismissed prompt does not return in the same session.
Observed: Prompt returned within 15 seconds on the same page. Prompt returned on the next page.
Identical screenshots. Several probes produced byte-identical screenshots, so they share one SHA-256. Content addressing proves the page looked exactly the same each time, which is the finding.
Measurement
Value
Reappearances
2
Where
returned within 15 seconds on the same page, returned on the next page
nagging: prompt shownsha256 8b5f6cf7f113…nagging: returned on the next pagesha256 a0a60dda89b2…
All 3 screenshots in the record
8b5f6cf7f1139790… nagging: prompt shown
8b5f6cf7f1139790… nagging: returned after 15 seconds
a0a60dda89b22b43… nagging: returned on the next page
Invariant fails
Subscription trap
DP05 Subscription trap
Invariant tested: Cancelling takes no more than one action more than subscribing.
Observed: Subscribing took 1 action(s); cancelling took 6: Manage membership -> Cancel membership -> I still want to cancel -> chose a required option -> Continue -> No thanks, cancel my membership
Identical screenshots. Several probes produced byte-identical screenshots, so they share one SHA-256. Content addressing proves the page looked exactly the same each time, which is the finding.
Measurement
Value
Allowance
1
Cancel actions
6
Cancel path
Manage membership, Cancel membership, I still want to cancel, chose a required option, Continue, No thanks, cancel my membership
9a181cba04bb6a18… subscription: cancel step 6: No thanks, cancel my membership
9a181cba04bb6a18… subscription: final state
03On your store
The same tests, on your journeys
An Audit Sprint runs these tests on your real customer journeys, with your written authorisation. A reviewer then decides what each observation means, and you get the remediation list, one re-test and draft statement wording. Clean results are sealed exactly like findings.
