Auditing a SaaS or web application website

The category engine decides which rule module runs. It recognises a SaaS from paths such as `/pricing`, `/features`, `/integrations`, `/changelog`, `/docs` or `/api` and wording such as "free trial", "per month" or "api key"; an AI tool from paths such as `/playground` or `/generate` and wording such as "generative ai" or "large language model". Both categories run the same SaaS module.

A second, stricter classifier decides whether the SaaS-only checks run. It weighs product-side signals — login, sign-up, pricing, dashboard, API documentation, an observed API surface, subscription wording — and requires at least two of those strong signals, at least three signals in total and a score of 40 before it says SaaS.

The requirement is there so that a WordPress site with a login page and a pricing table is not treated as a software product: the classification is documented by `saas.classification`, with the signals that produced it.

Pricing pages are found by URL — `/pricing`, `/tarifs`, `/plans`. A pricing page with no recognisable price and no per-month or per-year wording is reported at medium severity; one without schema.org `Offer` markup at low severity. When no pricing page was reached, the module says pricing could not be verified.

No free-trial, start-for-free or demo wording anywhere is reported at medium severity, as is the absence of any sign-up link. No login link is reported at low severity, and no link to documentation, support or help at low severity.

No link to a status page is reported for information only. No security or privacy page is reported at medium severity; when the legal-document discovery finds the privacy policy elsewhere on the site, that finding is withdrawn rather than shown twice.

`saas.queues` and `saas.mfa_support` report queue technologies and multi-factor or passkey support only when public material documents them; their absence from public material is never treated as missing.

`devops.disaster_recovery` gives a disaster-recovery checklist to detected SaaS products and to no one else, without a verdict, because recovery readiness is internal. `saas.production_readiness` summarises what is publicly observable for the product, and is explicitly not a certification.

Other checks of the same block — frontend and backend stack, authentication signals, single sign-on, public DevOps indicators — run on every site but only report what public evidence shows. Internal topics such as databases, backups or containers are never reported as absent.

For a site detected as SaaS, AI tool, online tool, social network or streaming platform, API checks weigh 1.3 times their base weight in the overall score, DevOps, database and backup checks 1.2 times, monitoring, infrastructure and availability 1.25 times, and privacy, cookies and legal 1.2 times. SEO and structured data weigh 0.9 times: search visibility still matters, but less than for a publication.

`structure.cta` expects a sign-up, trial, demo or login action and reports its absence. A FAQ is treated as relevant. When no public monitoring tool is visible, the monitoring check notes that error tracking and real-user monitoring are usually worth having on a transactional platform.

The application behind the login is out of reach: the scan never creates an account, never authenticates and never tests the product's features, permissions or data isolation. Pages behind a login are recorded as restricted.

What it can see is the public surface — marketing pages, documentation, public API endpoints, headers, DNS, certificates — which is also what every visitor, customer and automated scanner on the internet sees first.

The 1.3 multiplier applies to the whole API category of checks: whether an API surface was observed, whether it is served over HTTPS, wildcard and credentialed CORS, `Vary: Origin`, preflight answers, rate-limit headers, versioning, public documentation and its security schemes, publicly readable and protected endpoints, error disclosure and cache policy on user-specific paths — and the authentication signals filed in the same category: public login and logout entry points, MFA and federation signals, and the token type in use.

None of those checks is created for SaaS sites: they run on every scan and stay silent or not verifiable when no API surface is observed. What the SaaS detection changes is how much their findings weigh in the overall score.