What a scanner can't see

This site runs on vitrikit, our in-house design system. The upside of owning your own component base is being able to move fast without breaking everything. We got proof of that recently, running tahri.technology through several automated audit tools — security, accessibility, performance, SEO.

The results were instructive, not just for the fixes themselves, but for what we learned about how to handle them.

What we actually fixed

A few concrete examples:

• Security headers (CSP, HSTS, browser permissions) — a fully static site has no server to set these on the fly, so every page now gets its own security policy, generated automatically at build time.
• Keyboard and screen-reader accessibility — a skip link, a properly labeled contact form, navigation menus that are unambiguously identifiable.
• Dark mode — now activates automatically based on the visitor’s preference, then checked section by section to make sure no text became unreadable.
• Responsive images — the homepage hero image used to load the same full-resolution file on mobile and desktop; it now adapts to screen size.

The real lesson: verify before you fix

The most interesting part wasn’t the list of fixes — it was the list of false alarms. Several tools flagged issues that, once we dug in, weren’t actually issues: text contrast supposedly unreadable that was perfectly readable to the eye (the tool was misreading a drop shadow), images supposedly distorted that weren’t distorted at all, and a security policy flagged as “missing” when it was very much present — the tool simply didn’t know where to look for it.

Conversely, some real bugs were caught by no automated tool at all: a visual effect on the homepage image that had never actually rendered correctly for months, found only by scrolling the page ourselves.

The takeaway: an automated report is a good starting point, but it never replaces a human, hands-on check against the real product. That discipline — fix what matters, verify before claiming something’s fixed, and don’t chase every red line in a report — is the same one we apply on client projects as on our own site.

Got a similar question about your own project? Get in touch.