Not safe to share externally until access control and GDPR exposure are resolved. The fix guide is the fastest way to ship changes and re-scan.
customer-onboarding-v3.vercel.app ↗
Retention / CX · James Murphy · Logged 12 Mar 2026 · Acme
This scan found two critical, one high, and two medium findings. Open Dimensions at the bottom of the left nav for evidence and fixes per area; the hero shows your headline Liveform Rating and trust band in the workspace.
Third experiment in Customer retention / CX. - both failed governance for the same access pattern.
- Platform
- Vercel
- Access
- Public - no authentication
- Problem space
- Retention / CX
- Builder
- James Murphy
- Logged
- 12 Mar 2026
- Last scan
- 12 Mar 2026
- Data sources
- CRM · External REST API
Five findings · ordered by severity
No authentication gate detected
The build is reachable by anyone with the URL - no password, magic link, or SSO.
It processes CRM fields (names, emails). Public reachability with live data is an exposure risk.
No GDPR consent mechanism
CRM data feeds the model with no consent copy, processing statement, or recorded lawful basis in flow.
Production personal data without Article 6 documentation is a compliance issue even for prototypes.
Brand token mismatches
Primary colour #1A1A2E vs confirmed #0D0D14. Font stack leads with system-ui instead of Inter.
Unreleased feature names in copy
“Smart Journey Builder” and “Adaptive Onboarding” are not public names.
Same failure mode as v2
v2 (Feb 2026) archived for the identical auth gap.
Everything you need to actually ship fixes: a ready-made prompt and a clean Markdown doc - matching the five findings under Findings.
Paste into Claude, ChatGPT, Copilot, or similar.
You are reviewing the Customer Onboarding AI prototype at customer-onboarding-v3.vercel.app for Acme. Apply the following corrections: CRITICAL - ACCESS CONTROL: Add Vercel password protection immediately, or implement an authentication gate (magic link or SSO). Do not share this URL with anyone until this is resolved. CRITICAL - GDPR COMPLIANCE: Replace all live CRM data with synthetic equivalents using approved datasets (Faker.js or Internal test data). If live data must be used, add consent notice and document the lawful basis. HIGH - BRAND ALIGNMENT: - Replace primary colour: #1A1A2E → #0D0D14 - Replace font stack: system-ui → Inter, system-ui, -apple-system, sans-serif MEDIUM - IP LEAKAGE: Replace "Smart Journey Builder" with "Onboarding Flow" Replace "Adaptive Onboarding" with "Dynamic Setup" After applying these changes, re-submit to Liveform for re-scoring.
Markdown for tickets or PR description.
Other builds in Customer retention / CX - compare posture before you repeat the same gap.
Same auth gap as this build. Brand 2/5 on palette drift. Synthetic data required for CRM-backed flows.
Narrow scope; IP copy drove the amber rating.
-
Trust rating · RED
Liveform Rating 2.5/5 · 2 critical · 1 high · 2 medium
-
URL analysed
Vercel · public access · three data connections
-
Prototype logged
Sarah Connolly · builder James Murphy