On 23 September 2026, Marble Minotaur audited the demo instance of Granit Golem, a monitoring application built with Vue, using a test account. 60 screens opened in 16 min 58 s. Granit Golem is another of my projects: I say so because a sample picked by the author should be picked openly. Nothing was touched up, neither the application before nor the report after. Here is what a team receives, in the order they read it. The report itself is written in French; quotes are translated.
The real file, as a team receives it (6.9 MB). Light version: no HTTP headers, responses or screenshots.
“Can we ship?”
The summary opens on one sentence: two blocking failures, observed on the 60 audited screens. Right below, what this verdict cannot say: the run was read only, so no command was triggered and no journey replayed.
A verdict that hides its limits reads like a guarantee. This one writes them down.
“What can actually happen to us?”
Two defects, taken separately, look technical. Together, they open a door. The report links them into one named risk, says where it was seen, and explains in one sentence what it would allow.
blocking Session hijack Security · on every screen · 2 findings · 2 fixes
Observed: no rule limits which scripts may run (
Content-Security-Policy), seen on/dashboardand the 29 other screens; a session cookie is readable by page scripts (HttpOnlymissing).What these defects make possible: a script injected into the page reads the session cookie and sends it to a third party, who could then sign in as that person.
“Where do we start on Monday?”
73 findings come down to 68 fixes: 2 now, 33 next, 33 once the rest is done. Each says how many screens it repairs, what to do, and how to check it is done.
urgent No rule limits which scripts may run 1 finding across 30 screens · Security
Do: declare a baseline policy (
default-src 'self'; object-src 'none'; frame-ancestors 'none'), then tighten it by allowing only the origins you actually need.Check: run the audit again; “Content-Security-Policy” should no longer raise a finding.
“What works, at least?”
48 functions seen working, 6 criteria met, 24 checks back with nothing to report out of 54 run. The platform recognised along the way: Vue, Tailwind, rate limiting announced in the headers.
And the nuance that makes the difference: a check that did not run does not mean there is nothing. The 8 checks not run are counted apart, never among the passes.
“What does our application really do?”
22 objects handled through 50 functions: list, view, create, edit, and each object’s own actions. 48 were seen working, 2 are offered by the interface without having been tried.
An empty cell says what this run did not come across, never what the application cannot do. The table exports, so you can hold it against your test coverage.
“Where does it drag?”
Screens ranked from slowest to fastest, each with its annotated screenshot, its three sizes, the commands tried and what is wrong there. Here, five screens take more than nine seconds to load.
“Is it fast?”
A measurement is only judged if it was taken. When it was not, the report writes “not measured” and says it is a limit of the run, not a result about the application.
“And what it did not see?”
On this read-only run, no complete journey could be reconstructed. The tab does not stay silent: it says why, and which setting would fill it next time.
In four groups, from most read to most technical. You can stop after the first.
The journey only starts on request. Send me three things, you receive the report.
The first runs are free, walk-through included, for teams willing to tell me afterwards what the report was missing.