# Executive Audit Dossier: Coolify (coolify.io)
**EU European Accessibility Act (EAA), WCAG 2.2, Cyber Hygiene & AI Discoverability Audit**

- **Target Domain:** `coolify.io`
- **Organization:** Coolify
- **Industry Vertical:** INDIE PAAS & SELF-HOSTING TOOL (US/EU)
- **Primary Tech Stack:** Modern Web / SaaS
- **Estimated Annual Turnover:** $1M - $10M (Indie / SMB)
- **Target Executive Persona:** Founder & Head of Product
- **Audit Date:** 2026-11-07
- **Auditor:** AccessGuard Pro Executive Compliance & Cyber Defense Suite

---

## 1. Executive Summary & Statutory Exposure

| Metric | Score / Status | Severity Assessment |
| :--- | :--- | :--- |
| **WCAG 2.2 / EAA Vulnerability Index** | **43 / 100** | MODERATE RISK |
| **HTTP Security Headers Score** | **40 / 100** | Action Required |
| **AI Agent Discoverability (/llms.txt)** | **42 / 100 (D)** | Unindexed |
| **DMARC Email Anti-Spoofing Policy** | **NONE (MONITORING ONLY)** | Spoofing Vulnerable |

> **Statutory Regulatory Exposure:** [object Object]  
> Under mandatory transposition of **EU Directive 2019/882 (European Accessibility Act)** across EU member states (including the German BFSG and French Law 2023-171), digital service providers must satisfy EN 301 549 conformance effective **June 28, 2025**.

---

## 2. Technical WCAG 2.2 & EU EAA Violations

| Standard & Criterion | Severity | Status & Observed Finding |
| :--- | :--- | :--- |
| **WCAG 2.4.1 (Level A)** Bypass Blocks | Critical | Missing "Skip to main content" bypass link on initial keyboard focus. |
| **WCAG 3.1.1 (Level A)** Language of Page | Pass | <html> root tag specifies valid lang attribute. |
| **WCAG 1.1.1 (Level A)** Non-text Content | High | Detected 3 images completely missing programmatic alt attributes. |
| **WCAG 4.1.2 & 1.3.1 (Level A)** Form Labels | High | 2 input fields lack programmatic labels or aria-label attributes. |
| **EU Directive 2019/882** Accessibility Statement | Statutory | Missing discoverable EN 301 549 Accessibility Statement link. |

---

## 3. HTTP Security Headers & Domain Spoofing Defense

- **DMARC Policy:** `none (Monitoring Only)` (v=DMARC1; p=none;)
- **SPF Policy:** `SoftFail (~all)` (v=spf1 include:_spf.google.com ~all)
- **Missing Security Headers:** `Strict-Transport-Security`, `Content-Security-Policy`, `X-Frame-Options`

---

## 4. AI Agent Discoverability Audit (/llms.txt)

- **AI Search Readiness Score:** 42 / 100 (Grade D)
- **Status:** No /llms.txt found at https://coolify.io/llms.txt. Risk of invisible products in Claude, ChatGPT Search, and Perplexity.

---

## 5. Bespoke Remediation Sprint Proposal: 24-Hour Done-For-You Store & SaaS Compliance Fix

- **Fixed Investment:** **$299** (USD)
- **Turnaround:** **24 Hours**
- **Remediation Scope:**
  - Drop-in WCAG 2.2 AA accessibility fix (skip-link, alt tags, ARIA form labels, focus rings)
  - Custom /llms.txt AI search discovery file so ChatGPT, Claude & Perplexity recommend your products accurately
  - Strict HSTS, CSP & /.well-known/security.txt edge header hardening
  - Signed ITI VPAT 2.5 / Accessibility Statement page ready for your footer

### Direct Liquid / HTML Remediation Snippet
```html
<!-- 1. WCAG 2.4.1 Skip-to-Content link (Place immediately after <body>) -->
<a href="#MainContent" class="skip-link visually-hidden-focusable">Skip to main content</a>

<!-- 2. WCAG 4.1.2 Programmatic Label on Search & Form Fields -->
<input type="search" name="q" aria-label="Search Coolify catalog" placeholder="Search..." />

<!-- 3. EU EAA EN 301 549 Mandatory Footer Disclosure -->
<a href="/pages/accessibility-statement" rel="help">Accessibility Statement (EN 301 549)</a>
```

### Zero-Call Async Checkout & Instant Onboarding (PayPal / Corporate Card)
- **Approve 48-Hour Turnkey Sprint ($299):** [Click to Pay & Start 48h Sprint via PayPal](https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=ronan.chenlopes%40gmail.com&item_name=24-Hour%20Done-For-You%20Store%20%26%20SaaS%20Compliance%20Fix%20-%20Coolify%20(coolify.io)&amount=299.00&currency_code=USD&no_shipping=1&return=https%3A%2F%2Fronanchnlps-bit.github.io%2Fonboarding-portal.html%3Fdomain%3Dcoolify.io%26tier%3Dsprint)
- **Deploy Self-Serve Edge & Plugin Kit ($497):** [Click to Buy Instant Edge Kit ($497)](https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=ronan.chenlopes%40gmail.com&item_name=AccessGuard%20Instant%20Edge%20%26%20Plugin%20Compliance%20Kit%20-%20Coolify%20(coolify.io)&amount=497.00&currency_code=USD&no_shipping=1&return=https%3A%2F%2Fronanchnlps-bit.github.io%2Fonboarding-portal.html%3Fdomain%3Dcoolify.io%26tier%3Dtier1)
- **Subscribe Continuous CI/CD Retainer ($299/mo):** [Click to Subscribe Retainer ($299/mo)](https://www.paypal.com/cgi-bin/webscr?cmd=_xclick-subscriptions&business=ronan.chenlopes%40gmail.com&item_name=AccessGuard%20Continuous%20CI%2FCD%20Compliance%20Retainer%20-%20Coolify%20(coolify.io)&a3=299.00&p3=1&t3=M&src=1&currency_code=USD&no_shipping=1&return=https%3A%2F%2Fronanchnlps-bit.github.io%2Fonboarding-portal.html%3Fdomain%3Dcoolify.io%26tier%3Dtier3)
- **Direct Advisory Contact:** `ronan.chenlopes@gmail.com`

---
*Report generated by AccessGuard Pro Executive Advisory Suite.*