{
  "$schema": "https://saor.systems/schemas/audit/v1.json",
  "audit_id": "saor-aud-7f3c9e2a",
  "saor_core_version": "0.4.2",
  "engine": {
    "runtime": "saor-core",
    "host": "z420.workshop.local",
    "models": [
      {"id": "gemma3:12b",     "role": "log-correlation",    "provider": "google", "weights": "open"},
      {"id": "deepseek-r1:14b","role": "impact-inference",   "provider": "deepseek","weights": "open"}
    ],
    "isolation": "air-gapped (no egress to public inference APIs)"
  },
  "target": {
    "domain": "example-roofing.com",
    "stack_detected": ["WordPress 6.5", "WPForms 1.8.x", "Zapier", "Pipedrive"],
    "scanned_pages": 38,
    "captured_http_transactions": 1247
  },
  "scan_started_at":   "2026-04-29T09:14:02-05:00",
  "scan_completed_at": "2026-04-29T09:21:48-05:00",
  "duration_seconds": 466,
  "summary": {
    "leaks_found": 5,
    "by_severity": {"critical": 2, "high": 3, "medium": 0, "low": 0},
    "estimated_daily_lead_loss_count_range": [4, 7],
    "estimated_daily_revenue_at_risk_usd": 2100,
    "estimated_30day_revenue_at_risk_usd": 63000,
    "avg_ticket_assumed_usd": 300,
    "confidence": "high"
  },
  "findings": [
    {
      "id": "saor-find-001",
      "severity": "critical",
      "category": "crm_ingest",
      "title": "Pipedrive webhook ingest delta - 14% of form submissions never reach the CRM",
      "evidence": {
        "form_submissions_observed_30d": 412,
        "pipedrive_records_created_30d": 354,
        "delta_count": 58,
        "delta_percent": 14.1,
        "method": "form-action capture vs Pipedrive REST sync, deduped by submitter email + 5-min window"
      },
      "estimated_impact": {
        "leads_lost_per_day_range": [1, 3],
        "revenue_at_risk_per_day_usd_range": [300, 900],
        "confidence": "high"
      },
      "remediation": [
        "Replace single zapier hop with retrying webhook (3 retries, exponential backoff)",
        "Add CloudWatch-equivalent alarm: form_submission_count - pipedrive_create_count over rolling 6h",
        "Backfill the 58 missed records from form-storage table (still in WPForms DB)"
      ],
      "estimated_fix_effort_hours": 6
    },
    {
      "id": "saor-find-002",
      "severity": "critical",
      "category": "webhook_silent_failure",
      "title": "Zapier lead-router - 3 of 12 calls 4xx silently in last 24h",
      "evidence": {
        "zaps_inspected": 12,
        "failing_zaps": ["lead_router_v2", "smsfollowup_premium", "calendar_invite"],
        "zapier_account_quota_remaining_pct": 8,
        "root_cause_inferred": "monthly task quota exhaustion - failures return 200 to source but 429 to downstream steps"
      },
      "estimated_impact": {
        "leads_lost_per_day_range": [1, 2],
        "revenue_at_risk_per_day_usd_range": [300, 600]
      },
      "remediation": [
        "Migrate critical paths off Zapier to Make.com or self-hosted n8n (cheaper, no task limit)",
        "Add Zapier task-quota alert at 80%, 90%, 95%",
        "Retry buffer table for any non-200 from upstream"
      ],
      "estimated_fix_effort_hours": 10
    },
    {
      "id": "saor-find-003",
      "severity": "high",
      "category": "performance",
      "title": "TLS handshake duration 312ms - exceeds 200ms target on mobile networks",
      "evidence": {
        "p50_handshake_ms": 312,
        "p95_handshake_ms": 487,
        "tls_version": "1.2",
        "cert_chain_length": 3,
        "ocsp_stapling": false
      },
      "estimated_impact": {
        "mobile_bounce_rate_increase_pct": 6.4,
        "leads_lost_per_day_range": [0, 1]
      },
      "remediation": [
        "Upgrade hosting to TLS 1.3 with OCSP stapling enabled",
        "Move to a CDN-fronted edge (Cloudflare proxy is enough)",
        "Re-issue cert with shorter chain (2 certs max)"
      ],
      "estimated_fix_effort_hours": 2
    },
    {
      "id": "saor-find-004",
      "severity": "high",
      "category": "form_ux",
      "title": "Mobile keyboard occlusion - submit button hidden under iOS keyboard on Safari < 15",
      "evidence": {
        "affected_user_pct": 11,
        "field_count_in_form": 7,
        "viewport_height_at_submit_ios14": 280,
        "submit_button_y_position_px": 364
      },
      "estimated_impact": {
        "abandonment_rate_on_affected_devices_pct": 38
      },
      "remediation": [
        "Reduce form to 4 visible fields, progressive disclosure for the rest",
        "Add scroll-to-button on focus blur of last field",
        "CSS env(keyboard-inset-height) safe area"
      ],
      "estimated_fix_effort_hours": 3
    },
    {
      "id": "saor-find-005",
      "severity": "high",
      "category": "performance",
      "title": "TTFB p95 of 1.8s on mobile - lead capture form blocks for 1.8s before interactive",
      "evidence": {
        "ttfb_p50_ms": 180,
        "ttfb_p95_ms": 1804,
        "mobile_lcp_p95_ms": 4920,
        "render_blocking_resources_count": 7
      },
      "estimated_impact": {
        "mobile_session_loss_pct_at_p95": 32
      },
      "remediation": [
        "Defer the 4 non-critical scripts in <head>",
        "Inline critical CSS for above-the-fold",
        "Preload the form-handler endpoint",
        "Move Google Tag Manager to a worker (avoid render-blocking)"
      ],
      "estimated_fix_effort_hours": 4
    }
  ],
  "telemetry_sources": [
    "real-user metrics from cloudflare web analytics (last 30d)",
    "synthetic scan from 4 geo (LAX, DFW, ATL, NYC)",
    "wpforms entries DB diff vs pipedrive REST API",
    "manual replay of 14 sample submissions"
  ],
  "exclusions": [
    "did not audit ad creative or campaign targeting",
    "did not audit copy/messaging on landing pages",
    "did not modify any production system during scan"
  ],
  "next_steps": {
    "roadmap_doc": "roadmap_2026-04-29.md",
    "estimated_total_remediation_hours": 25,
    "expected_lead_recovery_after_fixes_pct_range": [12, 18]
  }
}