VedaLogic · VL HRM — Full Technical Audit V1

Section 1

Executive Summary

VedaLogic builds VL HRM — a cloud-based HR, payroll, and statutory compliance platform targeting growing Indian companies. The marketing website at veda-logic.com is built on a modern Laravel + Inertia.js + React + Vite stack and serves as the primary lead generation and product-discovery surface for the business.

4Critical

8High

7Medium

5Low

🔓

HTTP Not Redirected to HTTPS (SEC-001)

Plain-text HTTP access is available. Visitors, integrations, and automated tools that reach http://veda-logic.com receive a full 200 OK response without being redirected to HTTPS. All transmitted data — including login credentials — is unencrypted.

🤖

robots.txt Serves Third-Party JavaScript (SEC-002)

/robots.txt returns an HTML page loading http://cdn.jsinit.directfwd.com/sk-jspark_init.php — a 2022 domain-parking script. Google cannot read crawl directives; an unvetted external script executes on every crawler visit.

🗺️

Complete Internal Route Map Exposed (SEC-003)

Every public page embeds the full Laravel application route table (200+ routes) in the data-page HTML attribute via Ziggy. This includes /install, /install/database, /hr/employees, /api/media, /permissions, /roles, and /_debugbar routes.

⚙️

Server Configuration in Public HTML (COD-001)

globalSettings serialised to every page response includes: AWS key names, SMTP server, email credentials (currently placeholder), storage type, and is_saas: true. Any real values set by an admin become instantly public.

Section 2

Score Dashboard

Baseline indicators from automated HTTP checks and HTML source inspection. Not a substitute for full Lighthouse, penetration testing, legal review, or assistive-technology testing.

#	Category	Score	Rating	Key Finding
A	Business & Content	55	Moderate	Good product content; no analytics; footer date stale
B	UI / UX	60	Moderate	React SPA; dark mode; 12 fonts; jQuery + React
C	Accessibility	40	Poor	lang=en; SPA prevents source-based ARIA verification
D	Performance	28	Poor	Zero cache headers; 12 fonts; jQuery + React; no CDN
E	SEO	38	Poor	Sitemap OK; all meta JS-only; robots.txt broken; no canonical
F	Security	32	Poor	HTTP unforced; no HSTS; no CSP; route map exposed; version disclosed
G	Privacy / Legal	28	Poor	No Privacy Policy; no Terms; no cookie consent
H	Code Quality	42	Poor	Modern stack; config leak; route leak; jQuery; deprecated header
I	CI / CD / Deployment	35	Poor	No CDN; no cache; installer routes in prod; HTTP unforced

Section 3

Category Findings

Detailed findings by audit category. Evidence is from automated HTTP inspection and HTML source analysis.

A Business & Content

55/100

VL HRM positions itself as transparent, auditable payroll for growing Indian companies. The site has a mature content structure: 7 product module pages (Payroll, Statutory Compliance, Employee Records, Attendance & Leave, Recruitment & Onboarding, Performance & Training, Employee Self-Service), 6 industry solution pages, Pricing, Demo, Why VL HRM, Security, About, Contact, and a Resources section with 5 published articles on Indian compliance topics (TDS, LWF, PF/ESI, Professional Tax, payroll errors). The product differentiator — visible, traceable calculations — is clearly communicated.

Weaknesses: No analytics tracking means the business has zero visibility into which pages drive enquiries, where visitors drop off, or which campaigns convert. The footer copyright reads "© 2025 VL HRM. All rights reserved." — one year behind. The production HRM application (/login) is co-hosted on the same origin as the marketing site, mixing marketing surface area with the live application.

Items not tested: Content accuracy, pricing competitiveness, conversion rates, demo booking UX, CRM integration.

BUI / UX

60/100

Inertia.js + React SPA with dark mode (system preference detection on load). Navigation includes a Product mega-menu with module shortcuts and direct links to Why VL HRM, Pricing, and Resources. Properly structured content hierarchy.

Font loading is excessive: A single Google Fonts stylesheet loads 12 typeface families: DM Sans, Inter, Poppins, Nunito, Roboto, Open Sans, Lato, Montserrat, Plus Jakarta Sans, Manrope, Syne, and Material Symbols Outlined. This is a severe render-blocking payload with no justification for 12 families on a focused SaaS marketing site.

jQuery is loaded alongside React — a ~90 KB redundant library alongside a full component-based framework. Without analytics, all UX quality assessments are unmeasurable.

Items not tested: Mobile rendering, touch targets, form validation, 404 page, demo booking UX, dark-mode visual quality.

CAccessibility (WCAG 2.2 AA)

40/100

Check	Status	Evidence
HTML lang attribute	Pass	<html lang="en"> present on all pages
Page <title> in HTML	Fail	Server-rendered title is "VL_HRM" — overwritten client-side by JS
Skip navigation	Not tested	SPA rendering prevents source inspection
ARIA landmark roles	Not tested	React renders dynamically
Colour contrast (1.4.3)	Not tested	Requires visual inspection
Keyboard navigation	Not tested	Requires browser testing
Image alt text	Not tested	Images rendered client-side
Form labels	Not tested	Forms rendered client-side
Focus indicators	Not tested	Requires browser testing

Items not tested: Screen reader compatibility, contrast ratios, focus order, form accessibility, error states, dynamic content announcements.

DPerformance

28/100

Check	Status	Evidence
Cache-Control on pages	Fail	`cache-control: no-cache, private` on all responses
HTTPS available	Pass	TLS working on port 443
HTTP → HTTPS redirect	Fail	HTTP returns 200 OK — no redirect
Google Fonts load	Fail	12 font families in one stylesheet — major render-blocking payload
jQuery + React	Warn	/js/jquery.min.js loaded alongside Inertia + React bundle (~90 KB wasted)
Vite asset fingerprinting	Pass	Content-hashed filenames (e.g. app-Cu5gOz5Z.css) — ready for long-TTL cache
Module preloading	Pass	<link rel="modulepreload"> for JS chunks — correct Vite output
CSS preloading	Pass	<link rel="preload" as="style"> for critical CSS — correct
CDN	Not confirmed	No CDN identification headers; x-server-cache and x-proxy-cache headers present — may be nginx-level caching
Core Web Vitals	Not tested	Requires PageSpeed Insights

Key finding: Vite fingerprinting is correctly implemented but the assets are served with no-cache, private — so the cache-busting infrastructure is in place but the cache TTLs that make it valuable are absent. Setting assets to 1-year immutable cache is a configuration-only change with immediate performance benefit.

Items not tested: LCP, CLS, INP, Lighthouse score, image compression, font subsetting, Time to Interactive, CDN coverage.

ESEO

38/100

Check	Status	Evidence
HTTPS	Pass	Available and working on port 443
robots.txt	Critical Fail	/robots.txt serves HTML with <script src="http://cdn.jsinit.directfwd.com/..."> — not a valid robots.txt
Sitemap	Pass	/sitemap.xml — 27 URLs covering all product, solution, resource, and company pages
Sitemap lastmod	Warn	All dates static: 2026-07-14 or 2026-07-16 regardless of actual updates
Meta <title> in HTML	Fail	Server renders "VL_HRM"; correct title applied by JavaScript client-side only
Meta description in HTML	Fail	No <meta name="description"> in server-rendered HTML; set via Inertia client-side
Canonical tag	Fail	canonical: null in all page SEO props — no canonical in HTML
OG tags	Fail	og_image: null — no og:title, og:description, og:image in HTML
Twitter Card	Fail	No twitter:card in HTML
Structured data	Fail	No JSON-LD schema.org markup detected
hreflang	N/A	Single-language (English) site

Critical — JavaScript-only meta tags: The page SEO data (title: "VL HRM — HR, payroll & statutory compliance software for India", description: "Payroll you can actually read...") exists in the Inertia page props and is applied by React. Google's crawler may execute JavaScript and index the correct title. However, LinkedIn, WhatsApp, Facebook, and Twitter/X crawlers do not execute JavaScript and will share every page with the internal name "VL_HRM", no description, and no image. For a B2B SaaS product where LinkedIn is a primary channel, this is a severe SEO limitation.

Items not tested: Google Search Console coverage, keyword rankings, Core Web Vitals in GSC, backlink profile, crawl budget.

FSecurity

32/100

Check	Status	Evidence
HTTPS enforced	Critical Fail	http://veda-logic.com/ returns HTTP/1.1 200 OK — no redirect to HTTPS
HSTS	Fail	Strict-Transport-Security header absent from all responses
Content-Security-Policy	Fail	CSP header absent
X-Frame-Options	Pass	x-frame-options: SAMEORIGIN — clickjacking protection present
X-Content-Type-Options	Pass	x-content-type-options: nosniff — MIME sniffing protected
Referrer-Policy	Pass	referrer-policy: strict-origin-when-cross-origin — correct modern value
Permissions-Policy	Pass	camera=(), microphone=(), geolocation=() — browser APIs restricted
X-XSS-Protection	Warn	1; mode=block — deprecated, ignored by modern browsers; should be removed
Server header	Fail	nginx/1.29.8 — exact version disclosed on GET requests
Session cookie	Pass	vl_hrm_session: secure; httponly; samesite=lax — all correct flags
XSRF-TOKEN cookie	Warn	Secure; samesite=lax but not httponly — intentional for Laravel CSRF pattern
Ziggy route exposure	Critical Fail	200+ named routes serialised to public HTML — full application surface exposed
Installer routes	Fail	/install, /install/environment, /install/database, /update routes in public route map; redirect to /dashboard (installed) but still discoverable
DebugBar routes	Note	/_debugbar/* in route map; endpoints return 404 — disabled in practice, but routes still registered

Items not tested: Penetration test of admin endpoints, SSL certificate expiry, session fixation, token rotation, dependency CVEs.

GPrivacy, Legal & Compliance

28/100

Check	Status	Evidence
Privacy Policy	Critical Fail	/privacy-policy → HTTP 404
Terms of Service	Critical Fail	/terms → HTTP 404
Cookie Policy	Fail	No cookie policy page found
Cookie consent banner	Fail	No consent mechanism visible in HTML source
Analytics tracking	Note	No GA4, GTM, or third-party analytics detected — reduces consent obligation for now
Google Fonts request	Warn	fonts.googleapis.com request sends user IP to Google — third-party data transfer
DPDPA 2023 compliance	Not assessed	India's Digital Personal Data Protection Act 2023 — requires legal review

Key finding: A SaaS platform selling to Indian businesses in regulated sectors (Healthcare, Financial Services) must have a Privacy Policy and Terms of Service as legal baseline requirements under the IT Act 2000 and DPDPA 2023. Both pages return 404. Enterprise procurement teams — especially in Financial Services and Healthcare — will require these documents before vendor onboarding. Their absence blocks sales.

Items not tested: Full DPDPA 2023 compliance assessment, data retention policies, sub-processor list, data residency.

HCode Quality & Maintainability

42/100

Check	Status	Evidence
Tech stack	Pass	Laravel + Inertia.js + React + Vite — modern, well-maintained stack
Vite build pipeline	Pass	Content-hashed assets; modulepreload; CSS preload — correct Vite configuration
HTML <title>	Fail	<title inertia>VL_HRM</title> — internal app name visible as server-rendered title
globalSettings in HTML	Fail	AWS key names, SMTP config, email credentials, storage_type, is_saas in public data-page JSON
Ziggy route exposure	Fail	Complete Laravel route table (200+ routes) in public HTML — admin, HR, API, installer routes all visible
jQuery + React	Warn	/js/jquery.min.js loaded via <script> alongside full Inertia + React bundle
Deprecated X-XSS-Protection	Warn	Header deployed but ignored by modern browsers; creates false sense of protection
Inconsistent Server header	Warn	HEAD → Apache; GET → nginx/1.29.8 — two different layers responding inconsistently
CSRF meta token	Note	Standard Laravel pattern — expected and necessary
Installer package registered	Warn	laravel-installer routes still in production route map

Architectural concern — globalSettings exposure: The Inertia page props serialise the application's globalSettings database object into every page response. This is a standing data exposure risk. Any admin who configures real SMTP credentials, an AWS access key, or a payment API token in the settings panel will immediately expose those values to every anonymous visitor worldwide. This must be fixed before the product scales or the admin panel is used for real infrastructure configuration.

Items not tested: PHP code quality, composer dependency audit, npm dependency audit, server-side security of HRM application.

ICI/CD & Deployment

35/100

Check	Status	Evidence
HTTPS available	Pass	TLS working on port 443
HTTP → HTTPS redirect	Fail	http:// serves 200 OK — no redirect
Platform	Note	nginx/1.29.8 reverse proxy in front of Apache origin
Cache strategy	Fail	No-cache on all responses — no browser or CDN caching
Proxy cache headers	Note	x-server-cache: true; x-proxy-cache: MISS suggests nginx-level caching layer exists but is not being used
CDN	Unknown	No definitive CDN identification headers observed
Installer routes in production	Fail	/install routes registered in production route map
CI/CD pipeline	Unknown	No public repository found; deployment process not testable
Staging environment	Unknown	Not testable externally

Note: The presence of x-server-cache and x-proxy-cache response headers indicates a caching layer is deployed (likely nginx proxy_cache). However, x-proxy-cache: MISS on all tested requests indicates the cache is not being populated — likely because the Cache-Control: no-cache, private headers from the application instruct the proxy to bypass caching. Enabling caching at both the application and proxy level would immediately improve performance without infrastructure changes.

Items not tested: nginx configuration, Apache configuration, SSL certificate expiry, deployment pipeline, staging environment, CDN provider.

Section 4

Full Issue Register

All 24 issues sorted by severity. Each includes unique ID, evidence, business impact, recommended fix, owner, effort, and verification method.

Critical

SEC-001

HTTP not redirected to HTTPS — unencrypted browsing allowed

CriticalP0Quick Win

URLhttp://veda-logic.com/ EvidenceHTTP/1.1 200 OK — no redirect to HTTPS. No Upgrade-Insecure-Requests header enforced. ImpactLogin credentials, session tokens, form submissions transmitted unencrypted; susceptible to man-in-the-middle attacks on unsecured networks. FixAdd nginx server block: return 301 https://$host$request_uri; for port 80. Deploy HSTS (SEC-004) after redirect is confirmed stable. OwnerDevOps Verifycurl -sI http://veda-logic.com/ returns 301 to https://veda-logic.com/

SEC-002

robots.txt is an HTML page loading third-party JavaScript

CriticalP0Quick Win

URL/robots.txt EvidenceReturns content-type: text/html. Content is an HTML page with CSS loader animation and <script src="http://cdn.jsinit.directfwd.com/sk-jspark_init.php">. File last-modified: 07 Sep 2022. Script loads over insecure HTTP. Publisher ID: 9POBEX80W. ImpactGoogle cannot read crawl directives; all pages treated as unconstrained. Third-party script (directfwd.com) executes on every crawler visit — potentially serving redirect or tracking code. Domain-parking remnant may trigger Google quality signals. FixDelete current file. Create /robots.txt with content: User-agent: *\nAllow: /\nSitemap: https://veda-logic.com/sitemap.xml. Serve as text/plain. OwnerDevOps Verifycurl -sI https://veda-logic.com/robots.txt returns content-type: text/plain · content contains "User-agent: *"

SEC-003

Complete internal Laravel route map serialised to every public page

CriticalP0Medium

URLAll pages Evidencedata-page attribute contains ziggy.routes with 200+ named routes. Exposed routes include: /install, /install/environment, /install/database, /install/final, /update, /update/database, /hr/employees, /hr/employees/export, /api/media, /api/media/batch, /permissions, /roles, /email-templates, /trash, /_debugbar/open, /_debugbar/queries/explain. Full route list visible in browser DevTools on any page. ImpactAttackers can enumerate the complete application attack surface without any scanning tools; can directly target sensitive routes; can verify which admin and HR endpoints exist before mounting attacks. FixCreate a separate Ziggy configuration for marketing pages. In config/ziggy.php, use the 'only' or 'except' option to include only the 5–8 routes needed by the marketing frontend (landing-page, demo form, contact). Exclude all admin, HR, API, installer, updater, and debugbar routes from the public manifest. OwnerDeveloper Verifydata-page attribute on public pages contains fewer than 10 route entries; /install and /hr/ routes absent

COD-001

Server infrastructure configuration embedded in public HTML source

CriticalP0Medium

URLAll pages EvidenceglobalSettings in data-page contains (selected keys): aws_access_key_id: "", aws_bucket: "", aws_default_region: "us-east-1", aws_secret_access_key: "", aws_endpoint: "", aws_url: "", email_driver: "smtp", email_host: "smtp.example.com", email_username: "user@example.com", email_from_address: "noreply@example.com", email_port: "587", storage_type: "local", storage_max_upload_size: "2048", is_saas: "True". ImpactValues are currently placeholder/empty. However, the architectural pattern means that when a real AWS key, SMTP password, or API token is stored in the admin settings panel, it immediately becomes visible to every anonymous visitor worldwide. For a SaaS platform this is a standing critical risk. FixImplement PublicSettings::toArray() returning only: customColor, titleText, footerText, logoLight, logoDark, favicon, defaultLanguage, themeMode. Never pass infrastructure keys (AWS, SMTP, storage, email) to the Inertia shared props for public/unauthenticated pages. OwnerDeveloper Verifydata-page attribute does not contain aws_, email_host, email_username, storage_type keys

High

SEC-004

No HSTS — browsers cannot remember to use HTTPS

HighP1Quick Win

EvidenceStrict-Transport-Security header absent from all HTTPS responses ImpactWithout HSTS, browsers do not remember to enforce HTTPS on repeat visits — leaving a window for protocol downgrade attacks after the redirect (SEC-001) is fixed. FixAdd: Strict-Transport-Security: max-age=31536000; includeSubDomains — add only after SEC-001 HTTPS redirect is confirmed stable. Owner · VerifyDevOps · securityheaders.com shows HSTS present

SEC-005

No Content-Security-Policy — XSS not mitigated at header level

HighP1Small

EvidenceContent-Security-Policy header absent from all responses ImpactNo header-level protection against XSS injection. Particularly relevant for a platform handling Indian payroll data — any script injection could exfiltrate employee records or payroll data from authenticated sessions. FixStart with Content-Security-Policy-Report-Only mode to capture violations without breaking the site. After 4–6 weeks of clean reports, promote to enforcing CSP. Use report-uri to a monitoring endpoint. Owner · VerifyDevOps · securityheaders.com shows CSP header present

SEC-006

Web server version disclosed in response header

HighP1Quick Win

EvidenceGET requests return server: nginx/1.29.8 — exact version disclosed ImpactAttackers can target known CVEs for nginx 1.29.x without fingerprinting effort FixSet server_tokens off; in nginx.conf. Also investigate why HEAD returns "Apache" and GET returns nginx — standardise both. Owner · VerifyDevOps · curl -sI shows Server: nginx with no version

SEC-007

Laravel installer and updater routes registered in production route map

HighP1Small

EvidenceZiggy route map includes: LaravelInstaller::welcome (/install), LaravelInstaller::database (/install/database), LaravelInstaller::final (/install/final), LaravelInstaller::environmentSaveWizard (/install/environment/saveWizard POST), LaravelUpdater::database (/update/database), LaravelUpdater::final (/update/final). Routes redirect to /dashboard when installer is complete — but remain registered and discoverable. ImpactIf the installed lock file is deleted or the installer guard is bypassed, an attacker could reconfigure the database connection and take over the application. The routes being discoverable via SEC-003 means no scanning is required to find them. FixRemove the laravel-installer and laravel-updater packages from production composer.json. Or add explicit 403 middleware to all /install/* and /update/* routes as an immediate backstop while packages are removed. Owner · VerifyDeveloper / DevOps · /install returns 404 or 403; routes absent from Ziggy manifest

SEO-001

Social meta tags not in server-rendered HTML — JS-only rendering

HighP1Medium

Evidenceog_image: null in all page SEO props. No og:title, og:description, og:image, or twitter:card in server-rendered HTML. Correct SEO data (title: "VL HRM — HR, payroll & statutory compliance software for India") exists in Inertia props but is applied only by client-side React. ImpactEvery LinkedIn, WhatsApp, Facebook, and Twitter/X share of veda-logic.com shows title "VL_HRM" with no description and no image. For a B2B SaaS where LinkedIn content sharing is a primary discovery channel, this is severely damaging. Brand perception and referral traffic are both harmed. FixInject OG and Twitter meta tags server-side in the Laravel Blade layout: read page.seo.title, page.seo.description, page.seo.og_image from the Inertia page props and render them as <meta> tags in the initial <head> response. Create branded og:image assets (1200×630px) for each page template. Owner · VerifyDeveloper / SEO · LinkedIn Post Inspector shows correct title, description, and image for veda-logic.com

SEO-002

No canonical tags in server-rendered HTML

HighP1Small

Evidencecanonical: null in all page SEO props. No <link rel="canonical"> in any HTML source. ImpactGoogle may index multiple variants of each URL (trailing slash, UTM parameters, query strings) as separate pages. Link equity is distributed across duplicates rather than consolidated. FixAdd canonical tag server-side in Blade layout. Default to page URL if page.seo.canonical is null. Example: <link rel="canonical" href="{{ $page['props']['page']['seo']['canonical'] ?? url()->current() }}"> Owner · VerifyDeveloper · All pages include correct canonical in HTML source

PERF-001

All responses served with no-cache — zero browser or CDN caching

HighP1Small

Evidencecache-control: no-cache, private on all HTML and asset responses. x-proxy-cache: MISS indicates the nginx caching layer exists but is bypassed by the application cache headers. ImpactEvery page visit — including repeated visits from the same user — triggers a full origin request. Vite content-hashed assets (CSS/JS) receive the maximum performance benefit from 1-year caching, but that benefit is completely negated by the current no-cache headers. FixHTML pages: Cache-Control: public, max-age=300, stale-while-revalidate=60. Vite-hashed assets (build/assets/*): Cache-Control: public, max-age=31536000, immutable. Enable nginx proxy_cache for GET requests to marketing pages. Owner · VerifyDevOps · Response headers show appropriate max-age values; x-proxy-cache shows HIT on repeat requests

PRIV-001

No Privacy Policy or Terms of Service — both return 404

HighP1Medium

Evidence/privacy-policy → HTTP 404. /terms → HTTP 404. No footer links to legal pages. No cookie policy found. ImpactNon-compliance with India's IT Act 2000 (requires privacy policy for any website collecting data) and DPDPA 2023 (requires data processing disclosure). Enterprise procurement in Healthcare and Financial Services (two listed target verticals) requires vendor Privacy Policy and Terms as part of onboarding. Absence blocks deals. FixDraft and publish: (1) Privacy Policy covering: data collected, purposes, Google Fonts data transfer, DPDPA 2023 rights, data retention, contact. (2) Terms of Service. (3) Cookie Policy. Link all three from footer. Engage a legal professional for DPDPA compliance review. Owner · VerifyManagement / Legal · /privacy-policy and /terms return 200; linked from footer on all pages

Medium

PERF-002

12 Google Font families loaded in a single stylesheet

MediumP2Small

EvidenceSingle Google Fonts <link> requests: DM Sans, Inter, Poppins, Nunito, Roboto, Open Sans, Lato, Montserrat, Plus Jakarta Sans, Manrope, Syne, Material Symbols Outlined — 12 families at multiple weights each FixAudit which families are actually used in CSS. Reduce to ≤ 2 typefaces. Self-host or use font-display: swap. Remove Material Symbols if icon library has lighter alternatives. Owner · VerifyDeveloper · Google Fonts request loads ≤ 2 families

PERF-003

jQuery loaded alongside React / Inertia.js (redundant ~90 KB)

MediumP2Small

Evidence<script src="https://veda-logic.com/js/jquery.min.js"> loaded before Vite bundle on all pages FixGrep codebase for all jQuery usage ($ and jQuery references). Replace with native JS or React equivalents. Remove script tag. jQuery is redundant alongside a full React component tree. Owner · VerifyDeveloper · Network tab shows no jquery.min.js request

COD-002

Deprecated X-XSS-Protection header deployed

MediumP2Quick Win

Evidencex-xss-protection: 1; mode=block — this header was deprecated in 2019; Chrome, Firefox, and Edge all ignore it FixRemove the header entirely (or set to 0). Deploy a proper Content-Security-Policy (SEC-005) which provides real XSS protection. Owner · VerifyDevOps · Header absent or set to 0 in response

COD-003

Inconsistent Server header — Apache on HEAD, nginx on GET

MediumP2Small

EvidenceHEAD request: server: Apache. GET request: server: nginx/1.29.8. Two different server identifiers for the same URL depending on request method. FixInvestigate nginx proxy_pass configuration for HEAD vs GET routing. Ensure nginx handles all request methods consistently. Suppress version on both paths: server_tokens off (nginx), ServerTokens Prod (Apache). Owner · VerifyDevOps · Both HEAD and GET return identical suppressed Server header

SEO-003

Sitemap lastmod dates are static — not reflecting actual updates

MediumP2Small

EvidenceAll 27 sitemap URLs show lastmod of either 2026-07-14 or 2026-07-16 regardless of actual content update timestamps FixGenerate lastmod dynamically from CMS page updated_at column. Use Laravel's sitemap generation to pull real timestamps per URL. Owner · VerifyDeveloper / SEO · Sitemap lastmod values change when page content is updated

UX-001

No web analytics tracking — zero visibility into traffic or conversions

MediumP2Small

EvidenceNo GA4, GTM, Plausible, Mixpanel, Segment, or equivalent analytics scripts detected in HTML source on any page ImpactNo data on page traffic, visitor behaviour, demo booking funnel, campaign attribution, or SEO performance. Impossible to measure the impact of any future improvements without a baseline. FixImplement analytics before any marketing campaign. For DPDPA-friendly: Plausible Analytics (no personal data, no cookies). For full funnel tracking: GA4 with Consent Mode v2 and an Indian server-side proxy for data sovereignty. Owner · VerifyDeveloper / Marketing · Analytics events visible in browser Network tab on page load

ACC-001

Accessibility (WCAG 2.2 AA) not verified — SPA prevents source inspection

MediumP2Medium

EvidenceReact SPA renders all content client-side. HTML source shows only: <div id="app" data-page="...">. ARIA labels, skip navigation, focus management, colour contrast, and form labels cannot be assessed without a running browser. ImpactUnknown WCAG compliance level. Legal exposure under Indian accessibility guidelines. Poor experience for screen reader users — potential barrier for HR buyers with accessibility requirements. FixCommission a browser-based WCAG 2.2 AA audit using axe-core (automated) plus manual keyboard and screen reader testing (NVDA + Chrome, VoiceOver + Safari). Remediate all critical and serious violations. Owner · VerifyDeveloper / Designer · axe-core audit reports zero critical violations

Low

COD-004

Footer copyright year is 2025 (current year: 2026)

LowP3Quick Win

EvidencefooterText in globalSettings: "© 2025 VL HRM. All rights reserved." FixUpdate footerText in admin settings panel to "© 2026 VL HRM. All rights reserved." Automate with current year in future: © {year}. Owner · VerifyContent · Footer shows 2026

SEC-008

XSRF-TOKEN cookie not HttpOnly — intentional but documented

LowP3Quick Win

EvidenceXSRF-TOKEN cookie: secure; samesite=lax but not httponly. Readable by JavaScript on the page — required for Laravel's default CSRF mechanism. FixDocument this as intentional in security notes. Ensure SameSite=Strict or Lax on session cookie (already set to Lax). No change needed to XSRF cookie; verify token rotates per session. Owner · VerifyDeveloper · Documented in security notes

PERF-004

Dark-mode CSS preloaded unconditionally for all visitors

LowP3Small

Evidencedark-mode-DdEuTgz4.css preloaded via <link rel="preload"> for all visitors regardless of prefers-color-scheme system setting FixAdd media="(prefers-color-scheme: dark)" to the preload link tag. Light-mode users will not download the dark-mode CSS. Owner · VerifyDeveloper · Light-mode users do not request dark-mode CSS in Network tab

SEO-004

No structured data (schema.org) — missing rich results eligibility

LowP3Small

EvidenceNo JSON-LD schema.org markup detected on any page. No Organization, SoftwareApplication, FAQPage, or BreadcrumbList schema. FixAdd Organization + SoftwareApplication JSON-LD to homepage. Add FAQPage schema to product pages. Add BreadcrumbList to all pages. Implement server-side in Blade layout for consistent rendering. Owner · VerifyDeveloper / SEO · Rich Results Test shows valid schema for homepage

PRIV-002

Google Fonts request sends user IP to Google — not disclosed

LowP3Small

Evidencefonts.googleapis.com loaded on every page. Third-party request sends user IP address to Google servers. FixSelf-host the fonts (after reducing to ≤ 2 families per PERF-002). Or disclose Google Fonts data transfer in the Privacy Policy (once created per PRIV-001). Owner · VerifyDeveloper · Fonts served from veda-logic.com origin; or policy discloses Google Fonts

Section 5

Implementation Roadmap

Five phases from immediate security fixes to long-term quality hardening.

Phase 1 · Week 1

Security Baseline

Force HTTP → HTTPS redirect (SEC-001)
Replace robots.txt (SEC-002)
Add HSTS header (SEC-004)
Deploy CSP Report-Only (SEC-005)
Suppress nginx version (SEC-006)
Remove deprecated X-XSS-Protection (COD-002)

Phase 2 · Weeks 1–2

Legal & Trust

Publish Privacy Policy (PRIV-001)
Publish Terms of Service (PRIV-001)
Publish Cookie Policy (PRIV-001)
Link all legal pages from footer
Update footer year to 2026 (COD-004)

Phase 3 · Weeks 2–4

Architecture Fixes

Scope Ziggy to marketing-only routes (SEC-003)
Create PublicSettings class (COD-001)
Disable installer routes in production (SEC-007)
Server-side OG/Twitter meta tags (SEO-001)
Server-side canonical tags (SEO-002)

Phase 4 · Weeks 4–8

Performance & SEO

Configure cache headers (PERF-001)
Reduce Google Fonts to ≤ 2 families (PERF-002)
Remove jQuery (PERF-003)
Fix dark-mode CSS preload (PERF-004)
Dynamic sitemap lastmod (SEO-003)
Add structured data JSON-LD (SEO-004)
Implement analytics (UX-001)
Resolve server header inconsistency (COD-003)

Phase 5 · Weeks 8–12

Hardening & Quality

Promote CSP to enforcing mode (SEC-005)
WCAG 2.2 AA audit and remediation (ACC-001)
Self-host Google Fonts (PRIV-002)
Document XSRF cookie behaviour (SEC-008)

Phase	Timeframe	Items	Primary Owner	Focus
1 — Security Baseline	Week 1	6	DevOps	HTTP→HTTPS, robots.txt, HSTS, CSP-RO, headers
2 — Legal & Trust	Weeks 1–2	5	Management / Legal	Privacy Policy, Terms, Cookie Policy, footer
3 — Architecture	Weeks 2–4	5	Developer	Route map, globalSettings, installer, SSR meta
4 — Performance & SEO	Weeks 4–8	8	Developer / DevOps	Caching, fonts, jQuery, analytics, schema
5 — Hardening	Weeks 8–12	4	Developer / DevOps	CSP enforcing, WCAG, Google Fonts, docs

Section 6

Items Not Tested

The following could not be assessed from external HTTP inspection and HTML analysis alone.

Lighthouse / PageSpeed Insights (LCP, CLS, INP)

Mobile rendering across viewport breakpoints

Touch target sizes (WCAG 2.5.5)

Colour contrast ratios (WCAG 1.4.3 / 1.4.11)

Keyboard navigation walkthrough

Screen reader compatibility (NVDA, VoiceOver)

Focus indicator visibility and order

Demo booking form submission flow

Contact form submission flow

HRM dashboard and application internals

SSL certificate expiry date

nginx and Apache configuration files

CDN provider and edge presence

Static asset cache TTLs (JS, CSS, images)

Server-side rendering (Inertia SSR)

404 and error page design

DPDPA 2023 full compliance assessment

Penetration test of /install, /update, /api/* routes

DebugBar endpoint access with authenticated session

Session fixation and token rotation

Composer dependency CVE audit

npm dependency CVE audit

Image optimisation (WebP/AVIF, compression)

Google Search Console data

Keyword rankings

Backlink profile

Core Web Vitals in GSC

Crawl budget and index coverage

Resource articles full content review

Section 7

Tools & Commands Used

Tool	Command / URL	Purpose
curl	`curl -sI http://veda-logic.com/`	HTTP/HTTPS redirect behaviour
curl	`curl -sI https://veda-logic.com/`	HTTPS response headers (HEAD)
curl	`curl -sv https://veda-logic.com/`	Full TLS + response headers (verbose)
curl	`curl -sL https://veda-logic.com/`	Full HTML source inspection
curl	`curl -sI https://veda-logic.com/robots.txt`	robots.txt response type and headers
curl	`curl -s https://veda-logic.com/robots.txt`	robots.txt content inspection
curl	`curl -s https://veda-logic.com/sitemap.xml`	Sitemap structure and URL count
curl	`curl -sI https://veda-logic.com/product`	Product page headers
curl	`curl -sI https://veda-logic.com/about`	About page headers
curl	`curl -sI https://veda-logic.com/pricing`	Pricing page headers
curl	`curl -sI https://veda-logic.com/privacy-policy`	Privacy policy existence
curl	`curl -sI https://veda-logic.com/terms`	Terms of service existence
curl	`curl -sI https://veda-logic.com/login`	Login page accessibility
curl	`curl -sI https://veda-logic.com/install`	Laravel installer route accessibility
curl	`curl -sI https://veda-logic.com/install/environment`	Installer environment route
curl	`curl -sI https://veda-logic.com/_debugbar/open`	DebugBar endpoint accessibility
Python	data-page JSON parse + extraction	Inertia route map, globalSettings, page SEO props, modules, nav
HTML analysis	Page source inspection	Meta tags, fonts, analytics, cookies, CSRF token, Inertia structure
regex grep	Pattern matching on HTML source	AWS keys, email config, OG tags, analytics scripts

VedaLogic · VL HRMWebsite Audit V1 — Complete Findings

VedaLogic · VL HRM
Website Audit V1 — Complete Findings