Audit a Next.js site from the outside in one evening: curl, sitemap crawl, Lighthouse, axe
Outcome: a findings table (area, severity, evidence, fix status) you can hand to whoever ships. We ran this on useslop.com and it found no security headers beyond HSTS, a 134 KB gzipped…