We check your page for errors, free, no account needed. See how much we catch, and what we miss.
Press Run before you ship. The agent uses your product like a customer and files whatever is broken.
A recorded run · replayed faster than it happened
Five of 37 findings from one keyless run, each driven again in a real browser. Open any one.
1 occurrence on pricing — form. the submit button is visible and enabled, but the required field "company" is hidden and cannot pass validation — clicking submit does nothing, and nothing on the page says why.
a11y-rule · blocked-submit · desktop
Either show the required field so a visitor can fill it in, or take the required attribute off it. A required field that is hidden can never be filled, so the browser refuses the submit and writes "An invalid form control is not focusable" to the console — where no visitor will ever see it. On the page, nothing happens: the button is pressed and the form sits there. Acceptance: with the form empty, click submit and the browser should move the cursor to a field and ask for it.
1 occurrence on login — [name="ssoPassword"]. a password field is submitted to http://sso.notely.test/handoff over plain http, where anyone on the network can read it.
a11y-rule · insecure-password · desktop
Change the form’s action to https://. A password posted over http travels in plain text and anyone sharing the network can read it; browsers also block this as mixed content from an https page, which usually shows up as sign-in silently doing nothing.
1 occurrence on landing. a Stripe secret key is served to the browser in an inline <script> on this page — anyone who opens developer tools has it. Rotate that key now, then move the call it belongs to onto your server. (The value is deliberately not quoted here: this finding is stored and rendered, and a secret in a report is a second leak.).
a11y-rule · client-secret · desktop
Rotate the key immediately — assume it is already public, because anyone who opened developer tools could read it. Then move whatever used it to your server and have the browser call your server instead. Publishable keys (Stripe pk_, Firebase) are meant to be in the browser and are not reported here.
1 occurrence on pricing, partway down the page, just after the heading "Pro — $9/mo" — <select> "Not sure yet Free Pro" (select[name="plan"]). Element does not have an implicit (wrapped) <label> Element does not have an explicit <label> aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references.
a11y-rule · select-name · desktop
Select element must have an accessible name
1 occurrence on settings — form:nth-of-type(1). the page said "saved", but nothing was actually saved — changed "name" on this form, submitted, and reloading shows the value from before the change ("Sam Okafor").
a11y-rule · save-does-not-stick · desktop
Make the save handler actually write the change, and read it back when the page loads. A success message over a write that never happened is data loss wearing a green banner — the user typed it, you said saved, and it is gone.
Nothing to install, no tests to write. Paste your URL and check back in a few minutes.
01See each step in detailGive it one URL. The crawl follows the links, opens every page, and flags the ones that 404.
See what a crawl findsEvery bug arrives with the screenshot it took, the exact element, and the steps to hit it again.
How a finding is put together6359b5Either show the required field so a visitor can fill it in, or take the required attribute off it.
We hand it a person to be: a name, a device, a mood, and a reason to give up.
02How a test drive runsDrawn, not invented: 10,000 records of up to 25 dimensions, median of 14, from MatrAIx-Persona-8B, MIT licensed.
A dimension is one recorded trait: region, age bracket, how comfortable they are with technology, how much they trust it.
Ethnicity, religion, marital status and gender are not in the file. Simulated testers are not a replacement for real people.
Read the evidence, copy the prompt, paste it where you work. Each ends on a condition a re-run settles.
03The full walkthrough
Deduped and persistent, so one bug is one item however many runs find it.
The surface, the words on screen beside it, the selector, and every reason it failed.
Written for the AI coding tool you already have open, not for a ticket queue.
Which screens exist, what broke on them, and what you have since fixed. The console calls it Memory.
What it keeps, and how to clear it37 findings, and 7 kinds of failure repeated across screens.
Drawn from one run against Notely, a seeded test product, not a customer’s.
It starts knowing your screens, which ones need a login, and what you fixed. Nothing here was guessed.
labs memory prints everything it knows. labs memory reset clears
it, and facts unseen for forty runs drop.
Catch bugs from inside the coding agent you already have open. All of them call the same twenty-five tools.
The four places it runsThrough the connector in the browser, or in Claude Code over HTTP. Ask for a test; fix prompts come back.
As a connector, and from the Codex CLI. Hand it a task and a browser proves the fix landed.
Added under Settings, then mentioned in the composer. Findings, evidence and the gate arrive as tools the editor calls.
Connectors, the same OAuth as the browser
An MCP server in the agent panel
Point it at the endpoint and set the header
Context servers, configured per project
Both read the same server list
Tools over the same HTTP transport
Extensions that take an MCP URL
A URL and a bearer token is the whole setup