A technical audit of the Deal212 public website
A clear-eyed review of the live site: routing and HTTP behavior, the lead-intake endpoint, UI and accessibility, content accuracy, and SEO and performance. Every finding is classified by severity and comes with a fix and a remediation checklist you can work through.
Bottom line
The sites build on a solid SPA and backend that pulls real New York City public data, but the shell ships with several issues that matter immediately: unknown routes return HTTP 200 instead of 404, robots.txt and sitemap.xml return the homepage HTML, the lead endpoint is wide open, and the copy overstates scope. The good news is nearly everything below is fixable in a short window.
- 1
- 6
- 8
- 1
- 1
- 17
Key findings
The highest-severity items first. The full categorized list with snippets and checklists is on the Findings page.
SPA catch-all returns HTTP 200 for unknown routes, /robots.txt, and /sitemap.xml
POST /api/lead has no rate limiting, CSRF protection, or server-side validation
Honeypot field must be hidden from assistive technology
Scope mismatch: 'nationwide' claims vs a NYC-only property check
Property Check results lack required disclaimers
Non-unique titles and descriptions across pages
Missing robots.txt, sitemap.xml, and social/canonical meta
Methodology
This audit used only what an ordinary visitor can observe. No access beyond the public site was used, and nothing was automated against the target.
- Public, non-intrusive observation of rendered pages and response behavior.
- No login or authenticated access was used.
- No form submissions were made.
- No load or penetration testing was performed.
- Findings reflect what any ordinary visitor could observe on October 22, 2026.