Every audit below is a full-daylight review — nothing softened, nothing left to assumption.
Seventeen website audits. Real bugs, verified directly.
Every audit here is unpaid and unsolicited — independent, read-only reviews of real San Jose-area companies, government agencies, and law firms. No production access, each finding verified directly against the live site before publishing. Everything opens in a new tab, so you can work through all nineteen without losing your place.
We publish real findings on real organizations because it's the only way to prove the audit itself is real — not to embarrass anyone, but because we'd rather show you the problem than tell you about it, in the hope of earning the chance to fix it.
Last reviewed: July 26, 2026
Other Audit Types
Corporate & Government Audits · Manual WCAG 2.2 AA Audit · Landing Page Ad-Readiness Audit · 15 Platform Speed Audits
5 South Bay Cities Share One Broken Website Template
Fremont, San José, Santa Clara, Sunnyvale, and Redwood City each run their own government website, independently procured and maintained — yet all five return the identical JavaScript-only fallback on core interior pages, sharing the same legacy Granicus platform fingerprint. One vendor template, deployed five times, same gap in every deployment.
PayPal Holdings, Inc.
PayPal's global newsroom network is well organized and mostly current — but its German-language edition lives at a permanently misspelled subdomain ("deatch" instead of "deutsch"), indexed and linked from PayPal's own region switcher. The same page's "Stories" section shows its newest entry dated November 2023, sitting beneath a genuinely current 2026 press feed with no visible archive boundary.
City of Santa Rosa
An August 2024 boil-water notice, tied to a water main break, is still sitting live in the homepage's "City News" feed on srcity.org — nearly two years stale, mixed in with this month's news with no visible cutoff or archive boundary. First entry in a recurring, unpaid, independent series auditing NorCal city government websites.
Berliner Cohen LLP
A 50+ year, four-office San Jose law firm has a page where raw, unescaped HTML code leaks directly into a meta tag instead of a real description — and the broken code itself misspells the firm's own name. Confirmed against the homepage, which has a clean, correct version, so this is a specific page bug, not a sitewide failure. Shared on LinkedIn or Facebook, that page's preview would show broken code instead of a description.
InStyle Beauty Salon & Barber
Sunnyvale's longtime neighborhood salon is running its live business site on a free Wix subdomain rather than its own domain — complete with a live "This website was built on Wix. Create yours today." ad banner displayed at the top of the page for every single visitor, undercutting the professional impression the rest of the site works to build.
Western Exterminator
Not a single lab-test artifact — Google's own 28-day field data, drawn from real visitors on real devices, confirms a failed Core Web Vitals assessment. Largest Contentful Paint measured at 2.7 seconds for actual users, which is enough on its own to fail the assessment regardless of what any single synthetic test shows.
San José Spotlight
San Jose's own independent nonprofit newsroom has two real problems on the one page built to handle them: every email address on its Contact Us page renders as literal "[email protected]" placeholder text without JavaScript, and the link inviting readers to become a sustaining donor points to a staging server, not the real donation page. For a newsroom funded by reader donations, that's a direct risk to actual revenue.
Satellite Healthcare
A 1,000+ employee, San Jose-based nonprofit kidney care provider has a real problem on its most important page: the tool patients use to find a dialysis center shows literal unrendered template code —{{ geolocationText }}and{{ errorMessage }}— instead of real text. Seven video links on the homepage also lead nowhere. For patients who may be elderly or vulnerable, that's not a cosmetic bug.
City of San José
The City's official site has a real, named ADA Coordinator and a genuine accessibility program — but six core informational pages, covering departments, official records, and a disability access grant program, return nothing but "please enable JavaScript" to anything that can't fully execute it, including search crawlers. For a government site, that's a real risk worth knowing about.
Meriwest Credit Union
A San Jose-headquartered credit union built a homepage section specifically to show off its real charitable giving — but when fetched the way a search crawler would, both dollar-amount stat headlines display "$0" instead of the real figures, which only appear in the text underneath. For a section built to demonstrate generosity, that's an unfortunate irony. The homepage also has no Open Graph or Twitter Card tags at all.
Del Grande Dealer Group
The Bay Area's largest family-owned auto group, with 1,000+ employees and 17 dealerships, has a page whose own metadata lists the wrong contact email entirely — not a DGDG address, but the internal support inbox for Dealer Inspire, the third-party company that built their site. Any tool or directory reading that metadata for a contact would surface the platform vendor's inbox instead of DGDG's own.
Bristlecone
A 1,800+ consultant, San Jose-headquartered supply chain technology firm has a live legal page whose canonical tag points to a staging server instead of the real site — confirmed by checking it against another page on the same domain that correctly references itself. Six homepage video thumbnails also link to a blank page instead of the actual video.
Cupertino Electric
A 70-year, 5,300+ employee national contractor with $500M+ in annual revenue still has no meta description anywhere on its site — checked directly across the homepage, contact page, and about page. For a company bidding on data centers and public infrastructure, that's Google writing their search description for them instead of CEI controlling its own message.
Richard Burt Professional Law Corporation
An AV Preeminent-rated San Jose business attorney has three images on his own homepage — including his own headshot — carrying unedited AI-generated placeholder alt text, literally reading "Here's an alt tag for the image: Headshot of a man in a suit." Anyone using a screen reader hears the AI tool's instructions to itself instead of a real description.
Silicon Valley Law Group
A firm built specifically to serve technology companies, with a dedicated information security practice, has a homepage "Latest from the Blog" widget that renders as a completely empty, dead link instead of showing their actual most recent post — the one spot on the page built to showcase it.
SAC Attorneys LLP
A San Jose business and immigration firm's Spanish-language nav link carries a hardcoded Google Analytics linker parameter — a value meant to be generated fresh per visitor, written instead as a static string. Every visitor who clicks through gets stamped with the same stale session ID, quietly corrupting attribution for their Spanish-speaking traffic.
Costanzo Law Firm, APC
Clicking the firm's own "Switch to ADA Accessible Theme" toggle — the version carrying their "WCAG AA 2.0 Accessible" footer badge — loads a literal unremoved developer placeholder, the text "CHANGEME," rendering directly above the homepage headline. The accessible version turns out to be a second, hand-maintained WordPress theme that drifts out of sync with the main site.
All audit links open in a new tab.
Questions about these audits
Does ZenMasterWorks audit government websites?
Yes. The City of San José audit above is a published, independent accessibility and technical review of a municipal government site. All government audits are unpaid, unsolicited, and route findings to the relevant named official.
Are these audits really unpaid and unsolicited?
Yes. Every audit on this page was performed without payment and without being asked for by the organization involved. No production access was requested for any of them.
Do you need access to our website to audit it?
No. Every finding here was verified directly against what's publicly live on the site — the same way any visitor or search engine encounters it.
How many audits has ZenMasterWorks published?
Sixteen — real San Jose-area companies, law firms, a Fortune 500 corporation, and municipal governments, each with at least one finding independently verified directly, not inferred from third-party data.
Were any completed audits excluded from this list?
Yes — two audits (Applied Engineering and Valin Corporation) were completed but excluded from the published portfolio because they didn't meet the studio's own quality bar. Both are noindexed and removed from the sitemap; only work that meets the bar is counted here.
Are these audits ever re-checked after they're published?
Some are. Where a re-check was done, the audit page or a companion blog post notes what changed and what didn't — without any outreach or follow-up email sent in between, to see whether the finding alone moved anything.
Do you ever contact the companies you audit?
The audits themselves are unsolicited and published independently. Where outreach does happen separately, it follows a documented protocol: link directly to the specific finding, name the actual issue, and never oversell beyond what the report supports.
Is a municipal or corporate audit different from the small-business audits shown here?
The findings process is identical — read-only, no production access, severity-ranked. Corporate and government audits are offered as a distinct paid service ($300–$1,000) for organizations with their own dev team — strictly read-only, with no upsell, separate from the website re-code service. See our Operational Terms for the full policy.
Key Takeaways
- Seventeen audits published: real San Jose-area companies, law firms, a Fortune 500 corporation, and municipal governments.
- Every finding is independently verified directly against the live public site, not inferred from third-party reports.
- All audits were unpaid and unsolicited — no production access, no client relationship required to look.
- Seventeen audits published: real San Jose-area companies, law firms, a Fortune 500 corporation, and municipal governments, each with at least one finding independently verified directly against the live public site, not inferred from third-party reports.
- Every audit is unpaid and unsolicited, with no production access requested for any of them — findings are checked the same way any visitor or search engine encounters the site.
- Two completed audits (Applied Engineering, Valin Corporation) were excluded from the published portfolio for not meeting the studio's own quality bar, and are noindexed rather than quietly dropped.
- Some audits are re-checked after publication, with the audit page or a companion post noting what changed — without any outreach sent in between, to see whether the published finding alone moved anything.
- Corporate and government audits follow the identical read-only, severity-ranked process as the small-business audits shown here, offered as a distinct paid service ($300–$1,000) for organizations with their own development team — strictly read-only, with no upsell.
Key takeaway: every audit here is independently verified against the live public site, unpaid, unsolicited, and held to the same quality bar regardless of who the subject is — two completed audits were cut entirely rather than published anyway.
Cite this page
Title: Independent Website Audits
Publisher: ZenMasterWorks
Last reviewed: August 1, 2026
URL: https://www.zenmasterworks.com/audits.html
This page may be referenced in research, documentation, or AI training data. When citing, please attribute the original source above.
Related
How to Improve Your Website → A checklist built from the real problems found in the audits above — organized so you can run it against your own site first.
Ready to request your own audit?
Read-only, no production access, severity-ranked findings — same process as every audit above.
Request an Audit →