Sample: made-up site

See a sample report

Sample: made-up site. This is a sample report for shop.example, a site that does not exist. Every finding in it is made up.

Security report sample

The same sample in every format

Compliance pack sample

The law crosswalk and the EU Cyber Resilience Act (CRA) readiness section for shop.example, for these laws: EU CRA, NIS2, DORA, GDPR. Each row says what it is evidence for; duties yof cannot check are marked as not covered by yof.

What this report is and isn't

This report is a check of shop.example at one point in time, as of 2026-11-07. It covers the repository, the dependencies and the live addresses named in its scope section, and nothing else.

It was made by automated rules and tests. Depending on the scope, yof read the code, checked the packages, tested the live site and, with the owner's consent, ran attack tests. The scope section lists exactly what was done and what was not.

It is evidence to support your security and compliance work. It is not a certification, a conformity assessment or legal advice, and it does not assess governance, policies, processes or other duties that are not technical.

A result with no findings does not mean the app has no vulnerabilities. Automated checks cannot find every flaw. Weaknesses nobody knows about yet (zero-days), flaws in business logic and anything outside the scope may remain, and the app may change after the date shown.

As far as the law allows, yof's liability for this report is limited to the price paid for it. Consumer law where you live may not allow some of these limits; where it does not, they do not apply to you.

Sample yof report (made-up site)