Verdict: healthy. The new stack is deployed and serving. Every public page is live, the paywall data leak is closed, security headers and SEO are in order, and storage copy is consistent. One serious accessibility issue remains, plus a repo/production sync gap to reconcile.
19/19
pages return 200 (404 for unknown)
1
serious a11y issue (of 5 pages scanned)
5/5
security headers present
closed
signed-out paywall data leak
What's working
pass
All public pages serve
Home, /app, /pricing, /faq, /recipes, /legal, all /vs comparisons, SEO guides, recipe pages — all 200. Unknown paths correctly return a real 404.
pass
Redirects & UTM
hearth.produsa.app → bhook.produsa.app via 301, and utm_* parameters survive the hop into /app.
pass
Security headers
HSTS (preload), X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy, and a strict Content-Security-Policy all present on the home response.
pass
Paywall data leak — fixed
Signed-out GET /api/credits returns only {authed:false} (no prices, no Founder seat count). Signed-out /api/proof returns 401. The pre-launch leak is closed in production.
pass
SEO basics
/app now carries a <link rel="canonical">. sitemap.xml, robots.txt, llms.txt all serve.
pass
"Maa" copy
Home shows "Maa" five times with zero standalone "Ma" — the spelling fix is live.
pass
Storage messaging is consistent
FAQ states 200 MB free / 2 GB paid; the in-app vault-full toast and paywall pitch both say 2 GB (paid). No "200 MB paid" contradiction is live — an earlier concern that did not ship.
pass
Apple sign-in correctly hidden
"Continue with Apple" is gated behind the APPLE_ON flag (currently off), so it does not render. Remaining Apple references are legitimate iOS in-app-purchase code, not sign-in.
pass
Accessibility — 4 of 5 pages clean
/app, /pricing, /faq, /weekly-indian-meal-planner show no serious/critical axe violations at 390px or 1280px.
Issues to fix
1 · Home "Open this recipe" link is not visually distinguished serious a11y
Where: home page, figcaption > a[href$="hb_in_dal"] — the before/after card caption link. Flagged by axe as link-in-text-block at both 390px and 1280px.
Why it matters: the link is distinguished from surrounding text by colour alone, which fails for low-vision and colour-blind users.
Fix: add text-decoration: underline to .ba figcaption a. This one-line fix was prepared on a local branch but is not in the deployed build.
2 · Production is ahead of mainprocess
What: the live site runs the full new stack, but main still has only PR #1 merged, and the repo's wrangler.toml still reads database_id = "NOT-CREATED-YET" (the real D1 hearth database exists).
Why it matters: git no longer reflects what's in production, so rollback and the next deploy are built on a stale base. The open PRs (#2–#17) should be reconciled/merged and the real D1 id committed.
Deferred / post-launch
todo
Analytics loading
Consider loading GA + Clarity after first paint (earlier perf pass flagged third-party script cost).
todo
Rich Results test
Run Google's Rich Results test on /weekly-indian-meal-planner and the FAQ schema.
todo
Secret hygiene
Review and rotate deploy credentials as part of launch hygiene.