We signed up for 28 SaaS products as strangers. 24 had a defect in sign-up.

• 24 of 28had an open defect in sign-up, registration or the trial form. 17 of them at High or Medium.
  • 17 at High or Medium
  • 24 with an open defect
  • 4 with no sign-up we could use or test
• 10 of 28showed a price or a saving on the page that didn't match what you're charged or get.
  • 10 with a price that didn't match
  • 19 with a pricing or number defect
• 10 of 28fired ad or analytics tags without consent: before the cookie banner was answered, or after “Reject all”.
• 12 of 28told a stranger, on login, sign-up or password reset, whether an e-mail address has an account.
• About 55%of valid findings are visible before the user even logs in.
  • 110 on the public website
  • 90 on sign-up, login and reset
  • The rest, inside the app
• 67 of 250core app flows were not green. 60 of them failed on a real defect in the app.
  • 183 passed (73%)
  • 60 failed on a real defect
  • 1 our own wrong expectation
  • 6 couldn't run

• 28 products tested
• 381 findings filed
• 363 still valid after our re-check (95%)
• Median 12 valid findings per product
• 25 of 28 with at least one High still open

1. #1

   The front door: sign-up, registration, trial form

   24/28

   24 of 28 products · 17 at High or Medium

   One trial form failed on every first submit and worked on the second. E-mailed sign-in links that never work, so the only way in is “Forgot password”.

   The blind spot: The last person to test sign-up is usually the person who built it, on their own logged-in machine.

2. #2

   The price on the page is not the price you pay

   10/28

   10 of 28 products · 19 of 28 with a pricing or number defect

   Two different products advertised “save 20%” on yearly billing. On both, the real saving was 16.7%.

   The blind spot: Pricing lives in three places: the marketing site, the billing provider and the app. Nobody compares them after a price change.

3. #3

   The banner asks. The tags already fired.

   10/28

   10 of 28 products · 18 findings, 13 of them High

   Ad and analytics tags fired before the visitor answered the cookie banner, in some cases even after “Reject all”.

   The blind spot: Marketing adds a tag through a tag manager. Nobody re-checks the network tab after the next campaign. (Observed network behaviour, not a legal opinion.)

4. #4

   Your login screen answers strangers

   12/28

   21 findings · 15 products · 12 of 28 reveal who has an account

   Login, sign-up or reset screens that confirm whether an e-mail has an account. Passwords e-mailed in plain text. No e-mail verification.

   The blind spot: Each screen was written to be helpful. Nobody looked at all three together from an attacker's point of view.

5. #5

   Failures that stay silent or unclear

   14/28

   22 findings · 14 products

   A refused deletion reported as a success. Endless spinners instead of an error. A generic “unknown error” when the real problem was a server that couldn't be found.

   The blind spot: Error paths get clicked least, so they get tested least. Nothing throws an error, so an error tracker has nothing to catch.

6. #6

   The trial that leaves you stuck

   13/28

   21 findings · 13 products

   Trials that couldn't connect a data source or upload a file, locked features with no word on how to unlock them, wizards that saved an empty draft. In one product, a payment request on the first day of the free trial.

   The blind spot: Teams test onboarding with their own account, which has data, a paid plan and history. Nobody sees a fresh, empty trial.

7. #7

   Data that shows up wrong

   14/28

   23 findings · 14 products

   Dates in several formats across one app, times in the wrong time zone, a status that means one thing on the dashboard and another in the list, different phone numbers for the same office.

   The blind spot: Each screen formats its own data. Nobody compares the same record across screens, or the website with the app.

8. #8

   Broken links, sometimes on the money button

   19/28

   33 findings · 19 products · 3 with a call or trial button that opened a 404

   Links to pages that no longer exist, across navigation, help and policy pages. In 3 products, it was the button that books a call or starts a trial.

   The blind spot: The site and the app are deployed separately. URLs change on one side, and the other side never hears about it.

And the small stuff that adds up: 25 of 28 had a language leftover or a typo. None of these will lose you a customer on its own. Together they tell a prospect how carefully the rest was built.

1. Write down your 10 critical flows

The ones that would hurt if they broke silently. A starter list:

2 to 10. The one-hour checks

1. 2Sign up as a stranger after every releaseIncognito window, a new e-mail (you+release42@yourdomain.com), no saved passwords. Submit once. Did it work the first time?
2. 3Do the pricing mathFor every “save X%”, compute 1 − yearly ÷ (12 × monthly). Pay for 10 months and get 12: that saves 16.7%, not 20%. Then compare the pricing card, the comparison table, the checkout button and the invoice.
3. 4Open DevTools before you touch the cookie bannerIn the Network tab, filter by your ad and analytics domains. Load the page, click “Reject all” and reload. Anything that fires is a finding.
4. 5Ask your login screens who existsTry login, sign-up and reset with an e-mail that has no account, then with one that does. If any message differs, a stranger can tell them apart.
5. 6Crawl your linksnpx linkinator https://your-site.com --recurseThen click every call-to-action at the end of your product tour by hand.
6. 7Run a quick accessibility pass on sign-up and pricingnpx lighthouse https://your-site.com/signup --only-categories=accessibility --view
7. 8Mistype the password and look away for 10 secondsIs the error still there when you look back?
8. 9Open the dashboard of a brand-new accountDo the numbers make sense with zero data? Does any percentage divide by zero?
9. 10Switch the language and read only the buttonsLeftovers hide in buttons, e-mails and error messages, not in headlines.

1. 1Week 1

   Pick the flows, get the first findings

   1. W1
   2. W2
   3. W3
   4. W4
   5. W5
   6. W6
   7. END
   • We agree on your ~10 flows together: sign-up, login, pricing to checkout, your core action, invites, cancel.
   • The agent signs up as a stranger and walks them.
   • First findings with steps and screenshots in the first week.

   In October: median 1 h 41 min from starting on a new product to its first filed findings (13 products timed).

2. 2Weeks 2 to 6

   From your CI, or on demand

   1. W1
   2. W2
   3. W3
   4. W4
   5. W5
   6. W6
   7. END
   1. Your CI or one click
   2. ↓→
   3. ~10 flows run
   4. ↓→
   5. Report in minutes
   • We run it from your CI, or on demand: you or we click one button and get the report in a few minutes.
   • We improve and maintain the tests for you as your product changes.
   • You see a green run or a short list of real defects. Nothing else.
3. 3Every week

   A person reviews every failure

   1. W1
   2. W2
   3. W3
   4. W4
   5. W5
   6. W6
   7. END
   • A red test is a question: is it the app, or is it our test? We answer it before you see it.
   Red test

   ↓

   A person checks the trace and video

   App defect: sent to you, with evidence

   Our test: we fix it, you never hear about it

   In October, 15 of 381 findings didn't hold up on our own re-check. We closed them ourselves.

   Some sign-ups need a human step (CAPTCHA). We'll ask you for a test account.

4. 4End of week 6

   What you get

   1. W1
   2. W2
   3. W3
   4. W4
   5. W5
   6. W6
   7. END
   • Defects with steps, a recording and one line of business impact.
   • Your ~10 flows, running and maintained by us. Green means they work, red means a reviewed defect.
   • An end-of-pilot report: what we found, what your team fixed, what's still open.
   • When you hire QA later, they start from running flows and evidence, not a blank page.

   End of week 6: the report, and you decide whether to keep going.

Honest limits

• CAPTCHAs, bot walls and 2FA stop any unattended agentWe need a test bypass, a test account, or one human step. A CAPTCHA is protection, not a bug.
• The agent can be wrongThat's why a person reviews every failure. We promise evidence and review, not zero false alarms.
• It doesn't replace unit testsOr a QA lead's judgement. It covers the thin top layer unit tests can't see: can a user sign up, pay and do the main thing in today's build?
• It isn't a penetration test or a legal auditThe security and consent findings are the basics a careful user would notice.
• It takes a few rounds to settleExpect the first week to include test fixes on our side.

• Our first round was only 56% greenOn the 18 products with a full first round, 101 of 180 passed. After we fixed our own test wording and test data, 123 of 180 (68%). 20 of the 22 extra passes came from fixing our own tests; 2 came after the vendor apparently fixed the bug.
• 15 of 381 findings were our mistakeWe misread a setting, or couldn't reproduce it. We closed them ourselves. That's 4% noise, and it's why a person reviews findings before you see them.
• Our pass/fail judge doubted 8 of 10 passes on one productEvery one was checked against the trace. The rule now: proof, or it isn't a pass.
• Bot walls won some rounds7 sign-ups stayed blocked for an unattended agent, and three app suites never ran.
• We forgot a file5 tests on one product couldn't run because our sample file was missing. Not their bug. Ours.
• The cookie banner comes firstBanners blocked clicks until we made “accept cookies” the first step of every test. Obvious in hindsight.

What went right: from starting on a new product to its first filed findings with screenshots took a median of 1 hour 41 minutes (13 products timed). 21 products got their first findings in one evening, with agents working in parallel and one person supervising.

• 28 products from the top of a scored list of Czech and Slovak software companies, tested between 14 and 17 October 2026. Not a random sample of SaaS. Almost all are bilingual, which inflates the mixed-language numbers.
• Free or trial plans and public pages only, as any new user would. No paid tiers, real customer data, load tests or security probing beyond what a normal sign-up shows.
• Findings re-checked by a person on 16 and 17 October (341 of the 363 valid ones carry a re-check note). Of 381 filed, 15 were closed as our mistake and 3 as apparently fixed by the vendor, which leaves 363 valid. All counts come from one export taken on 19 October 2026.
• Severity and categories are ours. No vendor had confirmed any finding by 19 October. Consent findings describe network behaviour only and aren't a legal opinion.
• We don't publish product names, screenshots of tested apps, quoted error texts, exact amounts or details that would identify a product. If you think you recognise yours, you probably recognise a pattern that 10 other products share.