Audit Run 18 · May 10, 2026 · Auditor: Automated (Claude) · Tester account attempted: [email protected]

Summary

P0 PRODUCTION OUTAGE FOUND: Email auth on app.slateup.ai is completely broken. Both Sign Up and Sign In return a raw Supabase error: "Service for this project is restricted due to the following violations: exceed_storage_size_quota. Please reach out to Supabase support at https://supabase.help immediately." Confirmed multiple times today with [email protected] (new account) AND [email protected] (existing). New users cannot register. Existing email users cannot log in. The error is also a leak of internal infrastructure (Supabase project status) directly to end users.

Because auth is down, the in-app surfaces (onboarding, course generation, classroom, My Courses, Achievements, leaderboard, popovers) could not be re-verified this run. Marketing site checks ran normally.

PageSpeed could not be collected: the public PSI API returned 429 (daily quota exceeded for the shared API key), and the pagespeed.web.dev UI was blocked by a Cookie/query-string data filter in this browser context. Carrying May 9 numbers forward.

Bugs Open Status

🚨 New This Run

ID Bug Status
NEW-040 Auth completely down on app.slateup.ai. Both Sign Up and Sign In return the raw Supabase error Service for this project is restricted due to the following violations: exceed_storage_size_quota. Please reach out to Supabase support at https://supabase.help immediately. Reproduced with both a new account (hello+test10may) and an existing one (hello+test9may). Email auth is product-down. The error message itself is also leaking the backend provider name and a support URL into a public, unauthenticated error surface. 🔴 New (P0 · outage + infra leak)

High Severity (carried)

ID Bug Status
BUG-002 Slide 9 (Transformer Block) image rendering as transparent placeholder before fading in. ⚪ Could not retest (auth blocked)
NEW-003 Homepage demo widget still stuck on "Loading demo...". <video> element confirmed at readyState: 0, networkState: 2, duration: null. Source slate-demo.mp4 (preload="metadata"). No change in 5 audits. 🔴 Open
NEW-012 Pre-seeded ~74 courses on a fresh account. ⚪ Could not retest (auth blocked)
NEW-013 /how-it-works still renders the homepage hero, sections, and <title>. SPA falls through to homepage. Confirmed via body.innerText.includes('Your AI-powered interactive classroom') returning true and <title> = "Slate — AI-powered Interactive Classroom". 🔴 Open
NEW-014 /ncert still renders a fully blank page. body.innerText.length = 0. No content, no nav, no error. 🔴 Open
NEW-033 AI course generator leaks template placeholder text into student-facing slides. ⚪ Could not retest (auth blocked)

Medium Severity (carried)

ID Bug Status
NEW-007 "Somewhere else" tile word-break. ⚪ Could not retest (auth blocked)
NEW-019 "50% off your first month, just $10 to start" promo banner still appears on the Yearly tab on marketing /pricing. Confirmed today by clicking Yearly tab and reading body text. 🔴 Open
NEW-020 Marketing /pricing still shows "All AI Mates". In-app onboarding parity could not be retested due to auth outage. 🔴 Open (marketing-side)
NEW-021 Course-building 6 vs 5 vs 13 mismatch. ⚪ Could not retest (auth blocked)
NEW-022 Marketing nav: top-level header still varies across pages. Footer remains consistent on /blogs and /contact (Home / Blogs / Pricing). Same state as May 9. 🟡 Open (partial improvement persists)
NEW-028 Classmate name mismatch (Marketing uses Professor Sage / Noti / Deepa / Chuckle / Curio; in-app onboarding uses Note Taker / Deep Thinker / Class Clown / Curious Mind). Marketing side confirmed unchanged on homepage today. 🟡 Open (marketing-side)
NEW-029 Recommended-courses doesn't honour onboarding signals. ⚪ Could not retest (auth blocked)
NEW-032 Achievements leaderboard exposes real user names. ⚪ Could not retest (auth blocked)
NEW-034 Popover state not managed. ⚪ Could not retest (auth blocked)
NEW-037 Stale email pre-filled on /auth/login after sign-out (logged May 9). Today, on first nav to /auth/login, email field was empty (value: ""). Could not reproduce in this session. May be fixed or tied to specific cached state. 🟢 Could not reproduce today

Low / Polish (carried)

ID Bug Status
NEW-023 Em dashes still throughout marketing copy. Confirmed today: homepage body text contains 2 em dashes ("live, interactive lesson — slides...", "A new way to learn — powered by AI..."). /contact body still has 1 em dash ("or just have a question — we'd love to hear from you"). /blogs em dash count = 72 across 130 articles. 🔴 Open
NEW-025 Free-trial vs no-card welcome / pricing copy mismatch. ⚪ Could not retest (auth blocked)
NEW-026 Achievements "1 days" grammar. ⚪ Could not retest (auth blocked)
NEW-027 "50 total learners" stat placement. ⚪ Could not retest (auth blocked)
NEW-031 Page <title> em dashes. Homepage = "Slate — AI-powered Interactive Classroom" (still). /pricing = "Pricing — Start Free, Upgrade Anytime Slate" (still). /blogs = "Blog — AI Learning, NCERT Guides & EdTech Insights
NEW-035 Typo "originar" in Transformer Block image. ⚪ Could not retest (auth blocked)
NEW-036 JSON-LD em dash leakage. Two application/ld+json blocks now on homepage. The newer Organization + WebSite block has 0 em dashes (good). The older SoftwareApplication block still has 2 em dashes in the offer descriptions. 🔴 Open
NEW-038 app.slateup.ai desktop perf regression (May 9). ⚪ Could not retest (PSI API quota exhausted, UI blocked)
NEW-039 No password-strength / email verification on sign-up. ⚪ Could not retest (auth blocked)

Fixed / No New Regressions vs Prior Audit