← All work Case Study · Internal Tool

Opportunity Scanner — a safe website-audit engine

Opportunity Scanner is a website-analysis system that helps agencies and service businesses find conversion, SEO, performance, mobile, trust, and accessibility opportunities on a prospect's site — turning a manual review into a repeatable, client-ready report.

Evidence class: internal project result and observed technical result. Audit output is deterministic; recommendations still require human review.

Observed technical result: a single URL produces a scored, prioritized report across six defined categories, with bounded AI explanations based on detected findings.

How it works
URL Safe fetch (SSRF-guarded) 43 deterministic rules Weighted scoring Prioritized findings AI plain-English explanations Printable report

Every finding comes from a fixed rule, not a guess — the AI layer only rephrases what the rules already found, so the report stays correct and useful with or without it.

Sample report — synthetic data.
Why it was built

Manually auditing a prospect's website is slow and inconsistent — every reviewer checks different things in a different order. Opportunity Scanner runs the same 43 checks every time, across six categories, so a lead's website review becomes a repeatable, client-ready report instead of an ad-hoc write-up.

Key features
  • Scans a public website's homepage
  • 43 deterministic audit rules across six categories (conversion, SEO, performance, mobile, trust, accessibility)
  • Weighted scoring with prioritized fixes
  • Optional AI-written plain-English recommendations layered on top of verified findings
  • Client-ready printable report
  • Reports stay fully usable when AI or PageSpeed is unavailable (graceful degradation)
  • Structured data extraction (Cheerio) rather than storing raw HTML
Technical implementation
  • Next.js (App Router) + TypeScript (strict)
  • Tailwind CSS 4
  • Supabase / Postgres — server-role writes never exposed to client, RLS on anon key
  • Zod validation + React Hook Form
  • Hardened fetch boundary for untrusted URLs (src/lib/url-security.ts)
  • Staged, retry-safe scan orchestration
  • Anthropic API used only to rephrase verified findings (structured output)
  • 216 passing Vitest cases + a Playwright end-to-end flow
Architecture & security decision

AI is a bounded feature over deterministic, tested logic — never the source of truth. Every finding comes from a deterministic rule; the AI layer can only restate a verified finding in plain English, so a report is correct and useful even with AI turned off. Fetching arbitrary user-supplied URLs is done behind an SSRF-hardened boundary: it blocks private and reserved IPs, re-validates on redirect, and caps response size and time.

Limitations
  • Scans the homepage of a public URL, not a full-site crawl
  • A deterministic heuristic audit, not a substitute for a hands-on manual review or Core Web Vitals field data
  • PageSpeed and AI layers are optional enhancements
  • Internal tool, not a public self-serve product
What this demonstrates

Secure processing of untrusted input, deterministic audit logic with typed data collection, background/staged processing, AI used as an optional explanation layer rather than a source of truth, and real test and security discipline.