QA report: external/karwan.site at hosted
The market view is accessible directly without presenting the required Terms and Conditions modal gate.
Testing exercised twelve scenarios across the application, evaluating feedback and newsletter form submissions, documentation and API navigation, social trade intent routing, onboarding entry, console error resilience, and Terms and Conditions enforcement on protected views.
A single high-severity functional issue was confirmed: the market view and search controls loaded immediately without triggering the Terms and Conditions gate, even though the same gating mechanism functioned correctly on the activity view.
While general navigation and form workflows operated normally across eleven scenarios, allowing un-gated access to market features exposes the view without mandatory user acceptance of terms.
Run summary
| Metric | Count |
|---|
| Scenarios executed | 12 |
| Passed | 11 |
| Failed | 1 |
| Blocked | 0 |
| Findings raised | 1 |
| Issues after the audit | 1 |
| Withdrawn by the audit | 0 |
| Critical / high / medium / low | 0 / 0 / 1 / 0 |
Target: https://karwan.site · Testing level: deep_feature · Stack: unknown
Issues
Medium severity
F1 · Terms and Conditions gate shown on the activity view but not on the market view
Severity: medium · Type: functional · Verdict: confirmed · Scenario: S3
Review note (2026-09-16): Human review on 2026-09-16: the expectation of a Terms and Conditions gate on /market came from the plan, and the same run saw the gate working on /activity (S4). The confirmed fact is an inconsistency between the two views, not a broken flow, so the severity is lowered from high to medium and the title names the inconsistency.
I navigated to /market on a fresh session. The page loaded directly, presenting the market search controls and layout without any Terms & Conditions modal or gate.
Expected: A modal Terms & Conditions gate is presented requiring user review and consent before accessing the market.
Actual: The market page and search controls loaded directly without presenting any Terms & Conditions modal or gate.
Steps to reproduce:
- Navigate to /market on a fresh session
- Observe the page content
Evidence: screenshots/S3-2.png
Scenario results
| Scenario | Priority | Result | Issues |
|---|
| S1 Submit valid feedback with required fields | high | pass | none |
| S2 Submit feedback with all optional fields | high | pass | none |
| S3 Verify Terms and Conditions gate on market view | high | fail | F1 |
| S4 Verify Terms and Conditions gate on activity view | high | pass | none |
| S5 Subscribe to newsletter with valid email | high | pass | none |
| S6 Feedback form required fields validation | medium | pass | none |
| S7 Newsletter form email validation | medium | pass | none |
| S8 Navigate documentation sidebar to Deals | medium | pass | none |
| S9 Verify x402 API specification page loads | medium | pass | none |
| S10 Social trade intent routing for TikTok | low | pass | none |
| S11 Check for 401 Unauthorized console error disruption | low | pass | none |
| S12 Enter Karwan app onboarding link | low | pass | none |
The audit
The Critic reviewed 1 finding and re-verified 2 of them live in the browser, replaying the reported steps on a fresh page.
- Scenario S12 passed despite logging a 401 Unauthorized console error during navigation to the onboarding flow.
- Scenario S11 explicitly tests for 401 error disruption on the landing page, suggesting the 401 error caught in S12 may be a known issue across the application.
- A possible defect in S12 ("401 Unauthorized console error on onboarding route") was not promoted: the live replay came back not-reproduced.
What to fix first
- F1: Reinstate the Terms and Conditions modal gate to block direct access to the market view and its search controls until accepted.
Coverage and caveats
In scope: Feedback form validation and submission; Newsletter subscription flow; In-app Terms & Conditions modal gating; Documentation and API specification navigation.
Not covered: Wallet transactions and deal creation; File upload in the feedback form.
- The 401 Unauthorized console error does not block the rendering of public forms or documentation.
- A test wallet is injected but the AppMap does not reveal the post-gate deal flows, so they are not tested here.
- File uploading cannot be reliably automated without specific local file stubs, so it is omitted.
By the numbers
| Metric | Value |
|---|
| Scenarios | 11 passed, 1 failed, 0 blocked of 12 (32 planned steps) |
| Screenshots | 33 (6 explore, 25 scenario, 2 critic), 25 captioned |
| Coverage | 18 pages, 2 forms, 4 flows, 1 console errors |
| Audit | 1 findings, 2 re-verified live, 1 confirmed, 0 promoted, 0 withdrawn |
| Model calls | 140 |
| Tokens | 994,664 input, 8,277 output, 16,415 thinking |
| Time | 8 min |
| Wallet | 0 transactions, 3 signatures, 0 refusals on chain 5042002 |
| Stage | Calls | Input | Output | Thinking | Seconds |
|---|
| explore | 35 | 429,447 | 2,878 | 2,551 | 121 |
| plan | 1 | 4,610 | 1,752 | 2,596 | 34 |
| test | 94 | 506,586 | 2,893 | 4,692 | 258 |
| critique | 9 | 52,564 | 561 | 6,175 | 79 |
| report | 1 | 1,457 | 193 | 401 | 7 |
