Mechanism Audit Mechanism AuditJacaranda Labs
A 5-day written audit · fixed price

Know what is real in your product.

One careful visitor goes through your live product the way a paying customer would — sign-up, the core flow, the edges — and writes down what is real, what is only painted on, and what a customer cannot tell apart.

Book the audit · $450 Run the free self-check Delivered in 5 working days. If we find nothing real, you pay nothing.

Fast products look finished before they are.

A screen can be beautiful and still be an empty shell. A dashboard can show numbers that nothing calculates. A privacy page can promise something the code never does. The person who notices is usually a customer, at the worst possible moment — or an auditor, before they pay.

The demo is the product

Flows that were built for the pitch deck and never wired to anything behind them.

Claims with no page

“SOC 2 ready”, “bank-level encryption”, “GDPR compliant” — with nothing behind the sentence.

Template residue

Lorem ipsum, stock testimonials, default meta titles, and privacy text copied from a generator.

The ten checks

Every audit runs the same set, in the same order, with evidence recorded for each. Nothing is reported on a hunch.

Does the core flow finish?Sign up, do the one thing the product is for, and see whether it completes without a developer watching.
Is the data real?Whether numbers on screen come from something that computes them, or were typed into a fixture.
Where does the money go?Test-mode keys in production, a checkout that never charges, a plan that grants nothing.
Can a stranger recover?Password reset, email verification, and what happens on a second device.
What do the claims rest on?Security and compliance language checked against a page, a document, or nothing.
Where does your data go?Third-party calls fired on load, tracking before consent, forms that post somewhere unexpected.
Broken links and dead endsEvery link a customer might click, confirmed by fetching it rather than trusting the markup.
Template residuePlaceholder text, stock testimonials, default titles, generated legal pages.
What a link preview saysThe card shown when someone pastes your URL into Slack or a message — often the first impression.
What breaks at the edgeEmpty states, an interrupted flow, a slow connection, a very long input.

What a finding looks like

Written for someone who has to decide what to fix first. One real finding from a recent audit, anonymised.

▲ Moderate

The email sign-up accepts addresses but nothing is ever sent

The form on the landing page posts to a handler that writes to the database and returns 200. There is no mail provider configured, and no job that reads the table — so a visitor who signs up is told “check your inbox” and receives nothing.

“Thanks — check your inbox for the confirmation link.” — shown after every successful submission, /signup, 14:22 UTC.

Fix: either wire the table to a real sender (about an hour with a transactional provider), or change the page to “we'll email you when it's ready” and stop promising a confirmation that does not exist.

Pricing

Fixed price, paid up front, delivered in writing. No subscription, no retainer, no seat count.

Start here

The Self-Check Pack

$19 one time
  • The same ten checks, written out
  • Pass condition and common failure for each
  • Instant download
Buy the pack
Most useful

The Mechanism Audit

$450 one time
  • One product, audited as a careful visitor
  • Written report in 5 working days
  • Every finding with evidence and a fix
  • 30-minute walkthrough call
Book the audit
Done for you

The Fix Sprint

$1,450 one time
  • Everything in the audit
  • Findings closed over two weeks
  • Every finding re-tested at the end
  • Pass/fail record to show customers
Start a sprint

Five days, in the open

You get told where the audit is at each stage. Nothing is written about a product we have not used.

Day 1Kickoff: what the product is meant to do, and the one flow that matters.
Day 2Walk it as a stranger. Sign-up, the core flow, the edges.
Day 3The ten checks, with evidence recorded for each one.
Day 4Written up: severity, evidence, the smallest fix.
Day 5Report delivered, walkthrough call, questions answered.

Questions

Do you need access to my code or database?

No. The audit is done from the outside, as a customer: a fresh account, a browser, and the public pages. If something can only be judged from inside, we say so instead of guessing.

Will you write about it publicly?

Never without permission. Findings are yours. We may ask later whether we can describe a finding without naming you, and “no” is a complete answer.

What if the product is genuinely fine?

Then the report says that, with the evidence, and we tell you before you pay for more. An audit that finds nothing is a result, not a failure.

What counts as a product?

One live web application and its public marketing site. A second product, an API, or a mobile app can be added, quoted separately.

Refunds?

If we cannot deliver the report in five working days, you are refunded in full. Once delivered, the work is done — but if a finding is wrong, it is removed and the price of the audit is credited.

Find out before a customer does.

Five days, one product, a written answer to the only question that matters: does it actually do what the page says it does?

Book the audit · $450