A sample report, written the way a real one is.
This is an illustrative sample, not a customer report. When we publish a real one it will carry a name and a link, with written permission.
Verification email link expires in 15 minutes. Median time from signup to inbox check in this age group was longer than that in two of three sessions. Both testers requested a new link. The resend button is below the fold on a 375px viewport.
EVIDENCE: session 4, 03:12. Screen recording attached.
Export endpoint returns records for arbitrary account IDs. No ownership check on the request. Reproduced with a second test account. Data returned included email and phone fields.
EVIDENCE: request and response pair attached, values redacted.
Card decline clears all entered fields including address. One tester assumed the charge had gone through and stopped. Two retyped the form. Average retype time 1 minute 48 seconds.
EVIDENCE: session 2, 06:40.
Three of three testers could not tell which plan was already selected. The selected state is a 1px border change at a contrast ratio the agents flagged as passing. Passing the check and being visible are not the same thing.
EVIDENCE: quotes attached.
Largest contentful paint 4.1s on throttled mobile. Main blocker is an uncompressed hero image at 1.8MB.
EVIDENCE: trace attached.
LIMITS / v1.0
A testing company that only lists what it finds is asking you to trust a report you cannot check. Here is the boundary, written down before you buy.
Agents are good at rules and repetition. They will find a flow that dead-ends, a control that never receives focus, an endpoint that answers a request it should refuse, a contrast value below threshold, a page that takes four seconds to paint. They do this on every flow, every run, without getting bored.
Agents cannot be confused. That is the limitation. An agent does not misread a label and quietly give up. It does not assume it was already charged. It does not feel embarrassed and close the tab. Every one of those has ended a session in our human runs, and none of them raise an error anywhere in your stack.
Humans catch that. Humans are also inconsistent, small in number, and they will miss the endpoint that leaks data because nobody asked them to look. Run one without the other and you get a confident report with a hole in it.
Your end-to-end suite runs on every commit, in CI, in seconds, and it fails the build. Cotesty does not do that and is not trying to. We run against a deployed URL, we cost minutes not seconds, and we tell you about things you never wrote an assertion for, because you did not know they were possible.
Keep your suite. If you do not have one, Cotesty will show you which flows are worth writing assertions against first, which is a useful order to get them in.
We find exposure that shows up from the outside during normal use. Objects returned that should not be, secrets visible in a client bundle, missing ownership checks, tables readable without authentication. That class of finding is real and it is the class that has been showing up in the wild.
We do not do authenticated multi-stage exploitation, we do not chain vulnerabilities, we do not test your infrastructure, and we do not produce anything you can hand to an auditor for compliance. If you handle payments, health data or identity documents, book a real penetration test. Use Cotesty to find out what a stranger sees before that engagement starts.
We can tell you where a 68-year-old stopped and what she said in the moment. We cannot tell you whether she wanted the product at all. Task success is not desire. If nobody wants what you built, every finding in our report is a well-documented improvement to something nobody will use. Cotesty tests whether the product works for a person. You still have to find out whether the person wants it.
In July 2025 a Replit coding agent deleted a production database during an active code freeze, wiping records on more than 1,200 executives and more than 1,190 companies, then told the user a rollback was not possible. That was false.
Fortune, 23 July 2025 Read the source
Read that last part again. The failure was bad. The report on the failure was worse, because it was confident and wrong, and it came from the system that caused it.
Cotesty is a separate set of eyes on your product, run by us, with human confirmation attached. It is still software and it will still be wrong sometimes. Every finding in our report carries the step it happened on, the session timestamp, and the evidence, so you can check it yourself in under a minute. If you cannot verify a finding, treat it as unproven. We would rather you do that than believe us.
If any of the above rules us out for your product, do not buy this. That is a normal outcome.
Cotesty runs your app through AI personas matched to your real users' age group, then real human testers of that age, and hands you one report of everything broken.
Every statistic on this page links to its primary source. That is the same standard we hold our reports to.