Break it, then stump me β a live site, a live session, nothing rehearsed
My new site is live, and I would rather hear what is broken from you than from a paying customer.
Two asks: try to break my site, and send me a problem you have not cracked.
I pick the ones that teach something, and ChatGPT and I work them out live β no script, no rehearsed answer, and no pretending we knew all along.
Five things to hunt β the list I would run on your site
every link -> the phone view -> what the server answers -> speed -> what a machine sees
- Every link β click through the whole site and note each dead one
- The phone view β open it on a real phone, not a window dragged narrow
- What the server answers β the redirect chain, the certificate, the page it really lands on
- Speed β how long the page takes, then what happens when several people arrive at once
- What a machine sees β missing labels, broken markup, unreadable contrast, keyboard traps
The report I actually want β copy this, fill it in, paste it back
WHAT I DID opened /tools on my phone
WHAT I EXPECTED the tools to load
WHAT HAPPENED it answered 404
WHERE Chrome 154, Android, 4G
SHOT (drop the screenshot here)
Five lines, and I can fix it in one pass.
Fifteen free tools for those five hunts β no signup
The tools, sorted by the five hunts
rare gem Β·
runs in the browser, nothing to install Β· every one free
1 Β· Every dead link on the site.
Crawl the whole site and list every dead link β lychee Β· lychee.cli.rs- The same crawl as a one-line command β linkinator Β· github.com/JustinBeckwith/linkinator
2 Β· The phone view, and what moved.
- Every screen size side by side, in one window β Responsively Β· responsively.app
Screenshot any page at any size, in a sweep β shot-scraper Β· shot-scraper.datasette.io
See exactly what shifted between two screenshots β reg-cli Β· reg-viz.github.io/reg-cli
3 Β· What the server really answers.
A TLS grade for any address, in a browser β SSL Labs Β· ssllabs.com/ssltest- The deep version of that audit β testssl.sh Β· testssl.sh
Read the security headers a site sends back β shcheck Β· github.com/santoru/shcheck
Assert redirects, headers and status codes from a text file β hurl Β· hurl.dev
4 Β· Speed, then load.
The page score with the reasons behind it β PageSpeed Insights Β· pagespeed.web.dev- The audit engine itself, on your own machine β Lighthouse Β· github.com/GoogleChrome/lighthouse
Send real traffic and watch latency live β oha Β· github.com/hatoo/oha
5 Β· What a machine catches that eyes miss.
A visual accessibility check, no install β WAVE Β· wave.webaim.org
The W3C markup checker, paste a URL and go β Nu Html Checker Β· validator.w3.org/nu
The accessibility report as one command β pa11y Β· pa11y.org
What happens to a problem you send
Picked for what it teaches, then worked through live on 2026-10-17T18:30:00Z β nothing staged, nothing rehearsed.
A session also runs as soon as a handful of good ones land.
Sometimes we may not solve the problem during the session at all. That is real technical work.
Send both things here
The site: bchicbcow.com Β· the live page: bchicbcow.com/ask-live
For the site half, a broken link and one line is plenty.
Bring the problem in onehack.st/tag/help.
π What I promise, and how I put this page online
No scripted answers. No rehearsed solutions. No fake failures. No predetermined outcomes.
We arenβt going to research your question beforehand and then pretend weβre figuring it out in front of you.
When we know the answer, we explain how we know. When we donβt, we investigate. When a first idea is wrong, you watch it fail. When something breaks, you watch it break. When weβre wrong, you watch us correct ourselves.
One of the principles Iβm using throughout the project is:
OBSERVE β PROVE β PASS β DOCUMENT β CHANGE β VERIFY AGAIN
Donβt change something because you think you understand the problem. Observe the actual system. Gather evidence. Establish a PASS/FAIL condition. Document what you found. Make one controlled change. Then prove what happened.
I used that process while putting Ask Us Live online. Unexpected HTTP behavior showed up during deployment, each layer was investigated instead of the server being changed at random, and it was not called finished until the public endpoint returned HTTP 200.
Please try to break it. Bring the weird stuff. Bring the thing that should work and simply does not.
!