A second QA pass, and making our live AI demos safe to share

The first QA pass looked at the site the way a visitor sees it. The second also called our live AI demos directly, the way a script would. That is where the more interesting findings were.

The demos show a count of free tries, but that count only lived in the visitor's browser, so a script calling the demo directly was not limited by it. The limit now also holds on the server. Sending the wrong kind of input, such as a number where text was expected, crashed the demo instead of answering clearly. It now gets a plain message. Error messages could, in rare cases, pass along internal text from the AI service; visitors now always see one friendly message. And if the AI is unusually slow, the demo stops waiting after a while and says so, and that try does not count against the visitor.

Smaller fixes went out the same day. 17 of our 37 pages had search titles or descriptions that Google would cut off; all of them fit now. One label on a dark panel was too low in contrast; it is fixed. Phones now get a booking link above the calendar, and the site has a standard page for reporting security issues. The last item, switching our strictest browser security setting from warn-only to blocking, went live that evening, after it ran clean in warn-only mode.

Two honest notes. We tested two speed tweaks four times each and removed both, because one made the page slower and the other changed nothing. And when a report said our home page loads 2.7 MB of images, we checked how that was measured: real browsers download about 0.3 to 0.4 MB. Measuring first saved us from fixing something that was not broken.

Written by Rushi Prajapati