B-81%
Quality Score
10
Pages
154
Issues
7.9
Avg Confidence
7.8
Avg Priority
61 Critical68 High25 Medium
>_ Testers.AI
AI Analysis
JB Hi-Fi scored B- (81%) with 154 issues across 8 tested pages, ranking #6 of 7 Australian retail sites. That's 33 more than the 120.6 category average (43rd percentile).
Top issues to fix immediately: "Network resource load failures: DNS resolution errors (ERR_NAME_NOT_RE" — Investigate DNS resolution for all external hosts used by the page (CDN/resource domains); "Geolocation retrieval failed (JSHandle error)" — Add robust geolocation handling: detect support, request permission with a clear UX, and gracefully fallback to alter...; "Network resource DNS resolution failures (ERR_NAME_NOT_RESOLVED)" — Identify and fix failing hostnames so they resolve correctly (check DNS for the hostnames used by the resources).
Weakest area — accessibility (6/10): Contrast and text sizing could be improved in banners; ensure keyboard access, skip links, and alt text are consistently implem...
Quick wins: Simplify the hero and create a clearer hierarchy for categories and promotions. Improve accessibility with better color contrast, readable typography, and keyboard navigation.
Qualitative Quality
JB Hi-Fi
Category Avg
Best in Category
Pages Tested · 10 screenshots
Homepage
www.jbhifi.com.au
www.jbhifi.com.au
www.jbhifi.com.au
www.jbhifi.com.au
www.jbhifi.com.au
www.jbhifi.com.au
www.jbhifi.com.au
www.jbhifi.com.au
www.jbhifi.com.au
Detected Issues · 154 total
1
Exposure of tracking identifier (__prz_uid) in console logs
CRIT P9
Prompt to Fix
In the frontend code where logs print __prz_uid, remove the value or redact it before logging. Replace console.log(__prz_uid) with a sanitized message like console.log('__prz_uid': 'REDACTED') or remove the log entirely. Ensure no internal identifiers (PII or tracking IDs) are written to the browser console. If telemetry is required, emit it only to secure server-side logging with proper access controls.
Why it's a bug
The console logs reveal a tracking/unique user identifier (__prz_uid). Even if the value is currently empty, logging an internal tracking identifier in the console can lead to unintended exposure, correlation across sessions, or misuse by attackers if the value later becomes populated. This constitutes potential privacy and security risk and is generally considered a bad practice to expose identifiers in client-side logs.
Why it might not be a bug
If __prz_uid is always empty or null and never populated, the immediate risk is low. However, the mere presence of a tracking identifier variable in logs is against best practices and could become a risk if the value is ever assigned. Treating this as a potential exposure ensures proactive privacy hardening.
Suggested Fix
Remove or redact the __prz_uid value before logging. If a tracking identifier must be logged for debugging, mask or hash the value (e.g., log '__prz_uid': 'REDACTED' or 'PRIVACY_SAFE_HASH'). Alternatively, avoid console logging of internal identifiers entirely and centralize telemetry server-side.
Why Fix
Reducing exposure of internal tracking identifiers prevents potential cross-session correlation, minimizes surface area for sensitive data leakage in client consoles, and aligns with privacy best practices and data minimization.
Route To
Frontend Engineer / Privacy Engineer
Page
Tester
Pete · Privacy Console Log AnalyzerTechnical Evidence
Console:
[LOG] __prz_uid=
[LOG] __prz_uid=2
AI/LLM endpoint calls triggered on page load without user consent
CRIT P9
Prompt to Fix
Wrap all AI/LLM network calls behind a user consent flow. If consent is not given, do not call AI endpoints. Move critical AI calls behind a server-side proxy with proper privacy controls and ensure prompts are sanitized.
Why it's a bug
Console shows multiple instances of 'AI/LLM ENDPOINT DETECTED', indicating automatic calls to AI endpoints during page load. This can violate user privacy, affect load performance, and may breach consent expectations.
Why it might not be a bug
If AI features are required for the initial render, there should still be explicit user consent and transparency; current logs suggest no consent mechanism.
Suggested Fix
Defer all AI/LLM calls behind explicit user actions or consent banners. Gate endpoints behind feature flags, and proxy sensitive prompts through a server with proper privacy controls. Add telemetry to ensure users opt-in.
Why Fix
Protects user privacy, reduces unnecessary network traffic, and aligns with best practices for AI integrations.
Route To
Frontend Privacy/Security Engineer
Page
Tester
Jason · GenAI Code AnalyzerTechnical Evidence
Console:
⚠️ AI/LLM ENDPOINT DETECTEDNetwork:
AI endpoint calls detected on page load (no exact URLs shown in logs)3
AI/LLM endpoints invoked on page load (potential privacy/performance risk)
CRIT P9
Prompt to Fix
Audit all AI/LLM endpoint usage in the frontend code. Move calls behind explicit user actions (e.g., button click) or consent prompts. Implement lazy-loading for AI features, add a privacy consent toggle, and ensure no sensitive data is sent until consent is given. Provide a clear user-facing message about data usage before any AI calls.
Why it's a bug
The logs explicitly indicate AI/LLM endpoint detections on page load, which suggests AI-related network calls are triggered automatically without user interaction. This can lead to unnecessary latency, data leakage, and user trust concerns if prompts or data are sent before consent.
Why it might not be a bug
If the site intends to provide real-time AI-assisted features that load immediately for user convenience, this could be intentional. However, the presence of explicit 'ENDPOINT DETECTED' warnings and lack of visible user consent UI indicate a likely risk rather than a deliberate capability.
Suggested Fix
Defer all AI/LLM endpoint calls until explicit user action or consent is obtained. Implement lazy loading for AI features, centralize configuration for AI endpoints, and add a user-facing privacy consent prompt before any data is sent to third-party AI services.
Why Fix
Deferring AI calls protects user privacy, reduces initial page load times, and aligns with privacy-by-default expectations. It also prevents accidental data leakage and improves perceived performance.
Route To
Frontend/Privacy & Performance Engineer
Page
Tester
Jason · GenAI Code AnalyzerTechnical Evidence
Console:
⚠️ AI/LLM ENDPOINT DETECTEDNetwork:
GET/POST requests to AI endpoints detected on page load (AI/LLM endpoint calls triggered without user interaction).