BreakMyApp report

10 confirmed bugs in 10 pages and 30 interactions

http://127.0.0.1:4310/ · 2026-11-07T00:24:49.514Z · 40s · desktop, mobile
15 / 100score · 10 pages, 30 interactions
10pages explored
30interactions
5critical + high
5medium
0low
0suspected
2accessibility

The score starts at 100 and deducts 25 per critical, 12 per high, 5 per medium, and 1 per low confirmed finding. It reflects the areas this run tested, not the whole application. Limits: 25 pages, 100 actions, depth 4, 300s.

Findings

HIGH · Submitting the "Sign up" form on /signup with an apostrophe fails: POST /api/signup → 500

BMA-0001 · http-failure · confidence high · confirmed · /signup · desktop 1440×900

A request the application made to its own origin failed.

Expected

The request succeeds, or the application handles the failure and tells the user.

Actual

POST /api/signup → 500

Reproduction

  1. /signup
  2. fill Name "O'Brien"
  3. fill Email "o'brien@example.com"
  4. fill Password "O'Brien1!"
  5. click "Sign up"

Network

POST http://127.0.0.1:4310/api/signup → 500

Reproduction result

Reproduced in a fresh browser context.

Replay and share

npx breakmyapp replay BMA-0001 · npx breakmyapp card BMA-0001 · tests/BMA-0001.spec.ts
Screenshot for BMA-0001

MEDIUM · The "Sign up" form on /signup accepts an invalid email address

BMA-0002 · form · confidence high · confirmed · /signup · desktop 1440×900

The form submitted "not-an-email" as the email address and the server accepted it with HTTP 201. Neither the browser nor the application rejected the value.

Expected

The form rejects an invalid email address before or after submission.

Actual

POST /api/signup → 201

Reproduction

  1. /signup
  2. fill Name "Test User"
  3. fill Email "not-an-email"
  4. fill Password "Passw0rd!Test"
  5. click "Sign up"

Network

POST http://127.0.0.1:4310/api/signup → 201

Reproduction result

Reproduced in a fresh browser context.

Replay and share

npx breakmyapp replay BMA-0002 · npx breakmyapp card BMA-0002 · tests/BMA-0002.spec.ts
Screenshot for BMA-0002

HIGH · Loading /reports fails: GET /api/reports → 500, then throws TypeError: reports.map is not a function

BMA-0003 · http-failure · confidence high · confirmed · /reports · desktop 1440×900

A request the application made to its own origin failed, and the page threw an unhandled exception instead of handling the failure.

Expected

The request succeeds, or the application handles the failure and tells the user.

Actual

GET /api/reports → 500; TypeError: reports.map is not a function

Reproduction

  1. /reports

Console

TypeError: reports.map is not a function

Network

GET http://127.0.0.1:4310/api/reports → 500

Reproduction result

Reproduced in a fresh browser context.

Replay and share

npx breakmyapp replay BMA-0003 · npx breakmyapp card BMA-0003 · tests/BMA-0003.spec.ts
Screenshot for BMA-0003

MEDIUM · Link "Docs" on / points to a missing page (/docs → 404)

BMA-0004 · navigation · confidence high · confirmed · /docs · desktop 1440×900

The application links to /docs, but the server answers 404.

Expected

The page loads with a 2xx status.

Actual

HTTP 404

Reproduction

  1. /docs

Network

GET http://127.0.0.1:4310/docs → 404

Reproduction result

Reproduced in a fresh browser context.

Replay and share

npx breakmyapp replay BMA-0004 · npx breakmyapp card BMA-0004 · tests/BMA-0004.spec.ts
Screenshot for BMA-0004

HIGH · Selecting "Archived" for Show on /dashboard throws TypeError: Cannot read properties of undefined (reading 'length')

BMA-0005 · javascript-error · confidence high · confirmed · /dashboard · desktop 1440×900

An unhandled JavaScript exception occurred. Selecting "Archived" for Show on /dashboard left the page in an error state.

Expected

No unhandled exceptions.

Actual

TypeError: Cannot read properties of undefined (reading 'length')

Reproduction

  1. /dashboard
  2. select Show "Archived"

Console

TypeError: Cannot read properties of undefined (reading 'length')

Reproduction result

Reproduced in a fresh browser context.

Replay and share

npx breakmyapp replay BMA-0005 · npx breakmyapp card BMA-0005 · tests/BMA-0005.spec.ts
Screenshot for BMA-0005

HIGH · /old-dashboard redirects in a loop

BMA-0006 · navigation · confidence high · confirmed · /old-dashboard · desktop 1440×900

The browser gave up after following redirects from /old-dashboard that never reached a page.

Expected

The page loads.

Actual

The browser reported net::ERR_TOO_MANY_REDIRECTS.

Reproduction

  1. /old-dashboard

Reproduction result

Reproduced in a fresh browser context.

Replay and share

npx breakmyapp replay BMA-0006 · npx breakmyapp card BMA-0006 · tests/BMA-0006.spec.ts
Screenshot for BMA-0006

HIGH · /crash returns 500

BMA-0007 · http-failure · confidence high · confirmed · /crash · desktop 1440×900

The server answered 500 for /crash.

Expected

The page loads with a 2xx status.

Actual

HTTP 500

Reproduction

  1. /crash

Network

GET http://127.0.0.1:4310/crash → 500

Reproduction result

Reproduced in a fresh browser context.

Replay and share

npx breakmyapp replay BMA-0007 · npx breakmyapp card BMA-0007 · tests/BMA-0007.spec.ts
Screenshot for BMA-0007

MEDIUM · Mobile navigation button "Menu" does not open the menu

BMA-0008 · responsive · confidence high · confirmed · / · mobile 390×844

10 navigation links are hidden at 390px wide, and tapping "Menu" does not reveal any of them.

Expected

Tapping the menu button shows the navigation links.

Actual

No navigation link becomes visible.

Reproduction

  1. / @ mobile
  2. tap "Menu"

Reproduction result

Reproduced in a fresh browser context.

Replay and share

npx breakmyapp replay BMA-0008 · npx breakmyapp card BMA-0008 · tests/BMA-0008.spec.ts
Screenshot for BMA-0008

MEDIUM · /pricing overflows horizontally on mobile by 1230px

BMA-0009 · responsive · confidence high · confirmed · /pricing · mobile 390×844

At 390px wide the page scrolls sideways because div.wide (1600px wide) is wider than the viewport.

Expected

The page fits the viewport width without horizontal scrolling.

Actual

scrollWidth exceeds the viewport by 1230px

Reproduction

  1. /pricing @ mobile

Reproduction result

Reproduced in a fresh browser context.

Replay and share

npx breakmyapp replay BMA-0009 · npx breakmyapp card BMA-0009 · tests/BMA-0009.spec.ts
Screenshot for BMA-0009

MEDIUM · "Start free trial" on /pricing cannot be tapped on mobile because div.banner covers it

BMA-0010 · responsive · confidence high · confirmed · /pricing · mobile 390×844

The center of the control is covered by another element at 390px wide, so a tap reaches div.banner instead.

Expected

Primary controls are reachable on a phone-sized screen.

Actual

div.banner receives the tap

Reproduction

  1. /pricing @ mobile

Reproduction result

Reproduced in a fresh browser context.

Replay and share

npx breakmyapp replay BMA-0010 · npx breakmyapp card BMA-0010 · tests/BMA-0010.spec.ts
Screenshot for BMA-0010

Accessibility

2 axe-core rule violations across the pages tested. These do not affect the score.

ImpactRuleRouteElementsFix
criticalbutton-name
Buttons must have discernible text
/ desktop#helpFix any of the following: Element does not have inner text that is visible to screen readers aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element do
criticalimage-alt
Images must have alternative text
/ desktopimgFix any of the following: Element does not have an alt attribute aria-label attribute does not exist or is empty aria-labelledby attribute does not exist, references elements that do not exist or references elements that are empty Element has no title attribute Element's default semantics were not o

Exploration map

RouteTitleStatusDepthLinksInteractionsFindings
/ Home · Acme Tasks2000100
/signup Sign up · Acme Tasks20011012BMA-0001, BMA-0002
/login Log in · Acme Tasks2001109
/reports Reports · Acme Tasks2001100BMA-0003
/pricing Pricing · Acme Tasks2001102
/docs 404100BMA-0004
/dashboard Dashboard · Acme Tasks2001103BMA-0005
/old-dashboard 100BMA-0006
/settings Settings · Acme Tasks2001104
/crash 500100BMA-0007
/ mobileHome · Acme Tasks200000BMA-0008
/signup mobileSign up · Acme Tasks200100
/login mobileLog in · Acme Tasks200100
/settings mobileSettings · Acme Tasks200100
/pricing mobilePricing · Acme Tasks200100BMA-0009, BMA-0010
/dashboard mobileDashboard · Acme Tasks200100