What it does
A shop owner drops in their storefront URL. A few minutes later they get a PDF that names the five accessibility problems most worth fixing first, explains each one in language a non-developer can act on, and points at the theme or app that introduced it.
The last part is what makes it useful rather than noisy. Most automated accessibility scanners hand back a wall of raw WCAG violations with no sense of priority and no indication of who is responsible for the markup. If the broken contrast is coming from a review widget you installed, that's a completely different job than if it's coming from your theme — and it changes who you have to ask.
Why I built it
Accessibility lawsuits against ecommerce storefronts are a real and growing cost, and the people most exposed are small operators who have no idea their storefront is non-compliant. The gap looked like a good fit for automation: the detection is mechanical, the explanation is not.
The honest part: I built it before I researched the market, and it turned out audits of this kind were already being sold by other people. That was an expensive lesson and it changed how I start things now — market check first, then build. I kept going because the pipeline itself was worth finishing and the attribution angle is genuinely better than what I found being offered.
How it works
- IntakeA request form posts to a Netlify Function that screens for bots with Turnstile, a honeypot field, and per-IP rate limiting before anything expensive runs.
- DispatchThe function triggers a GitHub Actions workflow, which keeps the long-running crawl off the request path entirely.
- CrawlPlaywright walks the storefront and renders each page as a real browser would, so JavaScript-injected markup is included in the audit.
- Detectaxe-core runs the WCAG rule set against each rendered page and returns raw violations.
- AttributeViolations are traced back to the theme or the specific app that generated the offending markup.
- RankFindings are scored by severity and reach, and cut to a Top 5 — the point is a list someone will actually work through.
- ExplainClaude rewrites each finding into plain English with a concrete fix, rather than restating the rule ID.
- DeliverThe report is rendered to PDF and emailed through Resend.
Incident log
Things that were wrong, how they surfaced, and what I changed. This is the part of the project I'd actually want to talk about in an interview.
Confident reports about pages it never saw
An audit completed normally and produced a clean, professional-looking report — for a storefront that was sitting behind Shopify's password page. The report was well-formatted, internally consistent, and completely meaningless.
The crawler had no concept of whether it had reached the real storefront. A password gate or a placeholder page returns HTTP 200 with valid markup, so every downstream stage — detection, attribution, scoring, the plain-English rewrite — did its job correctly on the wrong input and produced a confident answer.
This is the worst failure mode a tool like this can have. A crash is obvious and costs nothing. A polished report that's wrong gets forwarded to a client, and the person it misleads has no way to tell.
Added a gate ahead of the audit that detects password walls and placeholder pages, aborts
the run, and sends an alert instead of a report. The tool now declines to answer rather than
guessing. Covered by the test suite — 24 tests passing at 7456d59.
Known limits
- Automated scanning catches a meaningful subset of WCAG issues, not all of them. Anything requiring human judgment — whether alt text is accurate, whether a flow is navigable in practice — is out of scope, and the report says so.
- Storefronts that are intentionally password-protected can't be audited without a credential handoff. That's deliberately unbuilt for now.
- The plain-English rewrite depends on an external API, which makes it the pipeline's single most fragile stage.
What I'd do next
- Charge for it. The economics already work — marginal cost per audit is near zero — so the missing piece is payment and the paperwork that comes with taking money, both deliberately parked until there's demand to justify them.
- Re-audit on a schedule and diff against the previous run, so the value is ongoing rather than one-shot.
- Track which recommendations actually get fixed, and use that to reweight the ranking.