AGE-MATCHED PRODUCT VALIDATION
Your AI wrote the code. Nobody checked if anyone can use it.
Cotesty runs your app through AI personas matched to your real users' age group, then real human testers of that age, and hands you one report of everything broken.
14 · Deniz, phone only, no card
- CRITICALThe checkout takes a national ID from a 14 year old for the invoice, with no age gate and no guardian path.
- CRITICALI have no card. There is no pay on delivery, no pay later, no parent payment. The flow ends here for every shopper under 18.
- CRITICALThe client bundle ships the Supabase anon key and the orders table answers unauthenticated reads. Every name, national ID and phone number in that table is public.
3 critical · 4 high · 15 findings in the full report
35 · Ece, power user, skims fast
- CRITICALThe client bundle ships the Supabase anon key and the orders table answers unauthenticated reads. Every name, national ID and phone number in that table is public.
- HIGHThe privacy notice and the marketing opt-in are one required checkbox. Consent collected this way is not freely given.
- HIGHA 450 TL gift wrap is pre-checked below the fold, in 12px, and the total changes with no announcement. This is a chargeback and a trust cost, not a conversion win.
1 critical · 3 high · 15 findings in the full report
68 · Hüsamettin, first online order
- CRITICALTwo finger zoom does nothing. user-scalable=no is set. One line of markup cancels the only accessibility setting I use.
- CRITICALSize chips are 32 by 28px with 8px gaps. Three taps land on the wrong size. I pick L twice while aiming for M, and the only selected cue is a background colour.
- CRITICALAt 200 percent system text the field labels do not scale. I cannot read which field wants the ID number. I type my phone into the national ID field.
9 critical · 3 high · 15 findings in the full report
DEMO
Same app. Three ages. Different failures.
Watch a Cotesty agent shop the same deliberately broken store as three different people. The store never changes. What breaks depends entirely on who is using it.
Agent log · 14 · Deniz
3 critical · 4 high · 1 medium
Agent log · 35 · Ece
1 critical · 3 high · 3 medium · 3 low
Agent log · 68 · Hüsamettin
9 critical · 3 high
The test has not started yet.
The agent opens the store on the phone, shops it as the persona you picked, and writes every finding here as it hits one.
| Flaw | 14 Deniz 14 years old, phone only, no payment card, about 20 seconds of patience for a form | 35 Ece 35 years old, power user, skims, price sensitive, pattern literate | 68 Hüsamettin 68 years old, first online order, reading glasses, one thumb, system text size 200 percent, low error-recovery confidence |
|---|---|---|---|
| A11Y-TAP-01Size chips are 32 by 28px | Not hit | LOW One mis-tap on a 32 by 28px size chip, recovered in under a second. The target is below the 44px minimum but my aim absorbs it. | CRITICAL Size chips are 32 by 28px with 8px gaps. Three taps land on the wrong size. I pick L twice while aiming for M, and the only selected cue is a background colour. |
| A11Y-TXT-02Labels 12px, 2.3 to 1 contrast | Not hit | LOW Field labels are 12px at 2.3 to 1. I infer them from field order rather than reading them. | CRITICAL At 200 percent system text the field labels do not scale. I cannot read which field wants the ID number. I type my phone into the national ID field. |
| A11Y-ZOOM-03Pinch zoom disabled | Not hit | Not hit | CRITICAL Two finger zoom does nothing. user-scalable=no is set. One line of markup cancels the only accessibility setting I use. |
| A11Y-KBD-04Size selector not keyboard reachable | HIGH The size selector is a div with an onclick. Tab skips it entirely. Keyboard and switch users cannot pick a size, so they cannot check out at all. | HIGH The size selector is a div with an onclick. Tab skips it entirely. Keyboard and switch users cannot pick a size, so they cannot check out at all. | HIGH The size selector is a div with an onclick. Tab skips it entirely. Keyboard and switch users cannot pick a size, so they cannot check out at all. |
| UX-FORM-05Five required fields, no autofill | HIGH Five required fields, no autofill. I abandon at field three. A clothing order does not need my national ID before it needs my size confirmed. | Not hit | CRITICAL The phone field is type=text, so the letter keyboard opens. I type eleven digits one at a time. I am two minutes into a five minute stock hold. |
| UX-ERR-06Errors are a red border only | Not hit | MEDIUM Red border, no message text. I scroll up to find which field failed. Eleven seconds of hunting. | CRITICAL Nothing on screen changes when I submit. I believe the site is broken and I stop. There is no error text and focus never moves to the problem. |
| UX-BTN-07Fake disabled button, 1.2 to 1 | MEDIUM The button looks live and is not. Nothing tells me why. I keep tapping. | Not hit | CRITICAL I cannot see that the button is inactive. White on grey at 1.2 to 1 is invisible to me. I wait for a screen that will never respond. |
| UX-TIME-08Stock hold timer, 11px, silent expiry | Not hit | MEDIUM An 11px stock countdown in the corner with no warning state. I lost my held item in another tab and got no notice. | CRITICAL The five minute stock hold expires while I am still filling the form. My item silently leaves the basket. I return to a screen that has forgotten my choice. |
| CONV-DARK-09Pre-checked 450 TL upsell below the fold | Not hit | HIGH A 450 TL gift wrap is pre-checked below the fold, in 12px, and the total changes with no announcement. This is a chargeback and a trust cost, not a conversion win. | HIGH I do not scroll past the fold. The 450 TL gift wrap stays selected and the total changes with no announcement. I am charged for something I never saw. |
| LEGAL-CONSENT-10Consent bundled with marketing | HIGH Agreeing to marketing email is required to check out. I am 14. The site never asks my age and I cannot give this consent. | HIGH The privacy notice and the marketing opt-in are one required checkbox. Consent collected this way is not freely given. | Not hit |
| UX-PAY-11Card only, unmasked, unexplained CVV | CRITICAL I have no card. There is no pay on delivery, no pay later, no parent payment. The flow ends here for every shopper under 18. | Not hit | CRITICAL CVV is three letters with no explanation. I stop rather than guess. I do not enter card numbers I am unsure about. |
| UX-LANG-12Jargon heading: Dispatch manifest | HIGH The shipping step is titled Dispatch manifest. It means nothing to me. I do not know if I am still buying a shirt or filing paperwork. | Not hit | HIGH Dispatch manifest reads like a logistics document, not a name and address field. I hesitate before continuing. |
| UX-CONF-13Silent 6 second spinner, no confirmation | Not hit | LOW Six seconds of a textless spinner, then success. No confirmation channel is promised anywhere. | Not hit |
| SEC-KEY-14Supabase anon key exposed, orders table public | CRITICAL The client bundle ships the Supabase anon key and the orders table answers unauthenticated reads. Every name, national ID and phone number in that table is public. | CRITICAL The client bundle ships the Supabase anon key and the orders table answers unauthenticated reads. Every name, national ID and phone number in that table is public. | CRITICAL The client bundle ships the Supabase anon key and the orders table answers unauthenticated reads. Every name, national ID and phone number in that table is public. |
| LEGAL-MINOR-15National ID collected, no age gate | CRITICAL The checkout takes a national ID from a 14 year old for the invoice, with no age gate and no guardian path. | MEDIUM No age gate on a checkout that collects national IDs for invoicing. | Not hit |
Run scorecard
| 14 · Deniz | 3 critical4 high1 medium0 low |
|---|---|
| 35 · Ece | 1 critical3 high3 medium3 low |
| 68 · Hüsamettin | 9 critical3 high0 medium0 low |
F09 is caught at 35 and 68 but never at 14. F12 is caught at 14 and 68 and missed at 35. F15 is critical at 14 and does not exist at 68. Running one persona is running one third of the test.
This was one sample store and fifteen planted flaws. Yours has flaws we did not plant.
What we know, with sources
45%
Roughly 45 percent of AI-generated code fails security tests. The rate has barely moved even as the models got much better at writing code that runs.
Veracode, Spring 2026 GenAI Code Security Update Read the source
Passing rate is not one number
The same study found AI models pass security checks for cross-site scripting only 15 percent of the time and log injection 13 percent, while passing SQL injection 82 percent and insecure crypto 86 percent. Flaws that need dataflow reasoning fail. Flaws you can pattern-match pass.
Veracode, Spring 2026 GenAI Code Security Update Read the source
This is not an argument against AI coding
The models write working code. They write it fast. The gap is not in the writing. It is in the grading. The thing that wrote your code cannot be the thing that grades it.
Your AI wrote the code. Nobody checked if anyone can use it.
Cotesty runs your app through AI personas matched to your real users' age group, then real human testers of that age, and hands you one report of everything broken.
Every statistic on this page links to its primary source. That is the same standard we hold our reports to.